hsts on main port 80, not on other ports

Question

I have set hsts for my domain on the site http://server.mydom.tld:80, so the brower goes to port https://server.mydom.tld on port 443

However, I also have other webservers, running on other ports. So when I go to http://server.mydom.tld:8888 it gets forwarded to https://server.mydom.tld:8888, but that server does not run https, so the request fails.

Is that according to spec?

I noticed I don't run hsts on http://mydom.tld or http://www.mydom.tld, which is probably a mistake.

What to do?

score 17 · Accepted Answer · edited Oct 07 '21 at 07:34

Yes, this is intentional. RFC 6797 states:

     The UA MUST replace the URI scheme with "https" [RFC2818], and

     if the URI contains an explicit port component of "80", then
     the UA MUST convert the port component to be "443", or>>

     if the URI contains an explicit port component that is not
     equal to "80", the port component value MUST be preserved;
     otherwise,

     if the URI does not contain an explicit port component, the UA
     MUST NOT add one.

     NOTE:  These steps ensure that the HSTS Policy applies to HTTP
            over any TCP port of an HSTS Host.

You should run plain HTTP services on a different domain, or even better, use a HTTP+TLS server as a reverse proxy to the internal plain HTTP service.

score 1 · Answer 2 · answered Jan 29 '19 at 12:09

1

The Strict-Transport-Security header is ignored by the browser when your site is accessed using HTTP; this is because an attacker may intercept HTTP connections and inject the header or remove it. When your site is accessed over HTTPS with no certificate errors, the browser knows your site is HTTPS capable and will honor the Strict-Transport-Security header.

answered Jan 29 '19 at 12:09

Somebody

11
1

That's all correct, but doesn't answer the question, I guess. – HorstKevin Jul 22 '19 at 08:25
It does answer the question "I noticed I don't run hsts on http://mydom.tld or http://www.mydom.tld, which is probably a mistake." – Lenne Oct 14 '20 at 11:41
This is correct but only applies to HTTP requests before an HTTPS request to the same domain. After that first HTTPS request responds with an HSTS header, all HTTP requests to port 8888 are redirected browser-side to https on port 8888. – Ed Greaves May 26 '21 at 16:35

score 0 · Answer 3 · answered Dec 13 '19 at 07:57

If one really doesn't want to run https on another service, one could add an alias in the DNS, so https://server.domain.tld and http://service.domain.tld:8888 are on the same IP/server

Then it is possible to add a redirect from http://service.domain.tld and https://service.domain.tld to http://service.domain.tld:8888

hsts on main port 80, not on other ports

3 Answers3