How does Firefox implement HSTS in detail?

Question

I did some research on how Firefox and Chrome fully implement HSTS (HTTP Strict Transport Security).

It turns out they have a predefined list with some sites that already implement HSTS. Here you can see here here and / or here . And this list seems to be somehow related to the source code itself, which has some meaning ... but how do Firefox and Chrome handle my own HSTS headers? How and where do they store my URL, my maximum age, and do I include SubDomains or not? I could not find it roughly: config or similar ....

So maybe someone knows more about this than me, I'm just curious (: thanks!

Answer 1

See http://hg.mozilla.org/mozilla-central/file/20bbf73921f4/netwerk/protocol/http/nsHttpChannel.cpp#l1072 and then http://hg.mozilla.org/mozilla-central/file/ 20bbf73921f4 / security / manager / boot / src / nsStrictTransportSecurityService.cpp # l249 which calls http://hg.mozilla.org/mozilla-central/file/20bbff393921f4/security/manager/boot/src/nsStrictTransportSecuritySlvice7pp

Thus, the data ends in the permission manager, which is the usual place for information about each host that is stored in Firefox. I think the permission manager keeps its state in permissions.sqlite .

Answer 2

Sites that want HTTP Strict Transport Security (HSTS) force a response in response - Strict-Transport-Security: max-age=31536000 maximum age is the time to expire. It is sent for each request, so that it is updated to a much larger amount of time with each request.

The browser (I tried only Firefox) stores this data with it and will use it every time the site is available. This is true even for incognito mode. If you have ever accessed a site before in non-incognito mode, the details of this site are saved and used even if you try to open it now in incognito mode.

For firefox, this data is stored in a file called SiteSecurityServiceState.txt , which is located in the Firefox profile folder. You can enter about:support in a browser, and then select "Show in folder" to open your profile folder, where you can find this file.

I'm not sure about the predefined sites, but the above is the file that updates the HSTS information on a regular site for firefox.

Learn more - High Security HTTP Traffic Security (HSTS) Overview

Answer 3

see also https://browserprivacy.wordpress.com/2013/11/26/firefox-24-1-1-hsts-network-stricttransportsecurity-preloadlist%e2%80%a8-urls/ for the current list of forced sites based on HSTS.