837952 - HSTS is still enforced when sending a HTTP header with max-age=0

Status: RESOLVED WORKSFORME

(Core :: Security: PSM, defect)

Description

[Biodark]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0
Build ID: 20130117041235

Steps to reproduce:

Sending a HSTS HTTP header to force HTTPS and with a high value
Header always set Strict-Transport-Security "max-age=399999; includeSubDomains"
Them after firefox forces HTTPS for the whole domain it ignores a new header with 0 as the value.
Header always set Strict-Transport-Security "max-age=0; includeSubDomains"


Actual results:

All pages where still HTTPS enforced.


Expected results:

All pages should stop to be HTTPS enforced.

Comment 1

[Matthias Versen [:Matti]]

Wouldn't hSTS not useless if it accepts lower values ?

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Matti: I don't know if this is what you're asking, but if a host sends an HSTS header with max-age=0, the user agent is supposed to clear HSTS state for that host.

Biodark: My first guess as to what's going on is that subdomains can't clear HSTS state for superdomains. Example:

example.com sends "max-age=399999; includeSubdomains"
child.example.com sends "max-age=0"
child.example.com is still observed to be an HSTS host (which is to be expected, as that's how HSTS is specified to work)

Anyway, if that's not the issue, more information would help us diagnose the problem. For instance, what hosts are sending what headers? Is there a public site you can point us to, with specific steps to reproduce the issue?

Comment 3

[Biodark]

I was sending the HSTS header with a high value in a htaccess file at the root of the domain but them changed the value to 0 so the HTTPS enforcement would stop but it doesn't stop.
I removed the .mozilla directory to try with a clean profile and the problem doesn't appear, but appears with the old directory even when running with the restart with all addons disabled option.

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler]]

I can't reproduce this locally. What does the web console say? (Tools -> Web Developer -> Web Console) In particular, what URLs are fetched and what do the response HSTS headers say before and after you change max-age?

Comment 5

[Biodark]

This is very strange the bug stopped being reproducible by me, the webconsole doesn't say anything about HSTS, but I can see the URLs are being fetched correctly now by HTTP and HTTPS when I test, maybe this was fixed on 18.0.2 or the bug just become more difficult to spot.

Comment 6

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Well, I'll close this for now, but feel free to reopen if it happens again.

Comment 7

[Biodark]

It is happening again...

Comment 8

[Dana Keeler (she/her) (use needinfo) [:keeler]]

In the web console, you can click on individual requests and look at the response headers the server sends. If you paste what you're seeing for the Strict-Transport-Security header, it may help diagnose and fix this problem.

Comment 9

[Biodark]

OK, I found the problem, the problem is that it takes some time for firefox to apply the new header changes, when I reopened this bug it never applied the new changes, I think, but now it takes 2 requests and two responses for it to apply.