Situation: site, supporting both HTTP and HTTPS. HSTS has been enabled. Powered by Apache 2.2.

Later, the site owner decides to only use HTTPS on certain pages (registration, orders etc.). However, the .htaccess redirection fails, since many site visitors' browsers have received HSTS headers already and won't show HTTP (leading to either redirection loops, or to HTTPS used everywhere).

Is it possible to disable HSTS redirections programmatically? The only working recipe, to clean all browser-kept data associated with the site, is far from perfect.

Attempts were made to send header like

Strict-Transport-Security: max-age=1;

and force redirection to HTTP after the set interval (1 second) has passed, but looks like not all the browsers can be tricked into that (redirection loops still happen).

Is the only solution - to ask users to manually delete mentioned site data?

  • 1
    Note: If the owner do not use HSTS and use https only on certain pages (registration, orders etc.) it means these https pages are vulnerable to trivial sslstrip attacks. It probably means the identification cookies are not secure (firesheep)... (Do you know there is an obligation of protection for personal data?) – Tom Aug 30 '16 at 14:48

According to https://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-11#section-6.1.1

" Note: A max-age value of zero (i.e., "max-age=0") signals the UA to cease regarding the host as a Known HSTS Host."

So set Strict-Transport-Security: max-age=0;

  • Tests showed, though, that this doesn't immediately work with all the browsers. But at least it works with some. – Konstantin Boyandin Sep 1 '16 at 2:04

No, it is not possible and it even not should be possible, it is again how HSTS works. Why would owner want to disable https support for normal pages? You should explain to owner that https is working best when used everywhere.

  • 2
    The underlying decisions (such as whether HTTPS should be used or should not) are outside of the scope of this question. Manual removing site-related data clears off the HSTS timeout records anyway. There's at least one legitimate case when HSTS is a major PITA: when I have to re-install LetsEncrypt and have to access the site in question via HTTP. – Konstantin Boyandin Sep 1 '16 at 2:06
  • @KonstantinBoyandin I have the same problem with HSTS and trying to get the first cert out of LetsEncrypt on a new host. It tries to connect with http-01 challenge and then errors out because of the HSTS. I've tried the max-age=0; mentioned above (in Apache httpd.conf) but this has not solved the issue. Any ideas? – jeffmcneill Apr 13 '18 at 16:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.