3

[copied from https://stackoverflow.com/questions/39937837/]

I've got my DNS set up to point local.example.com to 127.0.0.1. This is so that I can share cookies between the live site and my dev environment.

With HSTS activated on the live site, my browser automatically tries to access the local site at https://local.example.com/ which doesn't work as my dev server doesn't support SSL (I've tried serving at port 443).

Is there a way to instruct my browser (Chromium) to ignore HSTS?

(From what I've read, the includeSubDomains is very important to avoid cookie hijack attacks - basically I only want to include the subdomain exception for myself).

0

2 Answers 2

2

I'm not really sure if this of help in your specific situation (and you're aware of this "solution"), but one possible way would be to clear the browser HSTS cache. Maybe it's also possible to map this to a special key (combination), which would make it more easy to invoke it.

Here is how to do it with Chromium:

  1. Close all open tabs related to the page experiencing the issue.
  2. In a new tab type chrome://net-internals/#hsts.
  3. Locate the section header "Query Domain", enter the domain which is experiencing the issue in the text field next to "Domain:" and press the button labeled Query.
  4. Any domains that appear beneath the search query box will need to be deleted.
  5. Locate the section header "Delete Domain", enter the domain which is experiencing the issue in the text field next to "Domain:" and press the button labeled Delete.
  6. Repeat step 3 through 5 until the results of the query in step 3 state "Not Found".
  7. Close the browser and then re-open it, your issue should now be resolved.

Additional note: This only works if your domain isn't part of the HSTS preloaded list.

2
  • 1
    Very helpful, thanks. Note that some of the headers have changed slightly since this answer was written, but they're still very similar (e.g. "Query HSTS/PKP domain" instead of "Query Domain") Oct 29, 2019 at 16:01
  • 1
    Also note that you the domain needs to be an exact match to show up in the results, e.g. searching for mydomain.com might not bring up www.mydomain.com Oct 29, 2019 at 16:08
1

No, it is not possible to add exception. But HSTS only declare there must be valid certificate, nothing about which certificate it is (there is HPKP header for that), so you can generate your own self signed certificate, import it into chrome as trusted certificate and HSTS will works well even on localhost.

1
  • Thanks - that seems like a lot of work and overkill setting up my dev server to do the whole ssl thing, considering this will be the only use. I'll wait to see if anyone else comes up with a browser based setting but otherwise will accept your answer.
    – EoghanM
    Oct 14, 2016 at 13:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .