HTTP - the HyperText Transfer Protocol

If a website accepts a connection through HTTP and redirects to HTTPS, visitors may initially communicate with the non-encrypted version of the site before being redirected. This creates an opportunity for a man-in-the-middle attack. The redirect could be exploited to direct visitors to a malicious site instead of the secure version of the original site.

The HSTS header informs the browser that it should never load a site using HTTP and should automatically convert all attempts to access the site using HTTP to HTTPS requests instead.

1. a web client contacts a web server over HTTP (not HTTPS)
2. the server replies with a permanent redirection (HTTP301) to the HTTPS version of the website
   This redirect should already be in place even though you did not consider HSTS yet.
3. the client follows the redirection and connects to the website over HTTPS
4. the server replies normally and adds an extra :
   • Strict-Transport-Security header
   • with a max-age value
5. the client
   1. remembers to open next connections via HTTPS directly, even though the user typed/clicked an HTTP URL
   2. will abide by this behaviour for max-age duration
6. later, the client
   • _may_ retry connecting to the server via HTTP (not HTTPS) when max-age is elapsed
   • but when receiving the Strict-Transport-Security header again, the max-age value is reset, preventing the timeout from expiring

With HTTP 301 only

With HTTP 301 + HSTS

Summary : the difference

1. check the headers module is loaded
   httpd -M | grep headers

   headers_module (shared)

2. If it's not loaded yet, you'll need to add this somewhere :

   LoadModule headers_module modules/mod_headers.so

   or : a2enmod ...
3. add to the configuration of your HTTPS website :

   <VirtualHost 12.34.56.78:443>
   	
   	Header always set Strict-Transport-Security "max-age=31536000; includeSubdomains;"
   	
   </VirtualHost>

   31536000 is the number of seconds in a year. Start with smaller values while experimenting.
4. check the configuration
5. restart / reload the configuration
6. make sure you receive the Strict-Transport-Security header as expected :
   curl -I https://my.web.site/

   HTTP/1.1 200 OK
   Date: Mon, 09 Oct 2023 09:39:04 GMT
   Server: Apache/2
   Strict-Transport-Security: max-age=600; includeSubdomains;
   

• HTTP/2 explained by Daniel STENBERG (father of cURL, see also daniel.haxx.se) :
  • the HTTP/2 Explained book
  • TLS is not mandatory for HTTP/2
• https://en.wikipedia.org/wiki/HTTP/2
• rfc9113
• https://oxiane.developpez.com/tutoriels/java/http2-java/

Lighttpd

Varnish

1. the browser checks Cache-Control / Expires to determine whether or not to make a request to the server
2. if so, the browser adds Last-Modified / ETag headers to the HTTP request
3. if both client + server ETag values match, the server replies with an HTTP 304 code instead of an HTTP 200200, and no content. Then the browser will loads the contents from its cache.

• static resources (e.g. /var/www/html/path/to/image.jpg) will have distinct inode numbers on each web server. But since the inode numbers are used as part of the ETag hash algorithm, the same resource will have a distinct ETag value depending on which web server handles the request. This might be a reason for not using ETags.
• You can configure Apache and Lighttpd to not use inode numbers as part of the calculation but then you have to make sure the files timestamps are consistent across web servers so that identical ETags are generated.

Entity-Body

The Entity-Body is : entity-body := Content-Encoding( Content-Type( data ) ) (source). Its length (shown in Content-Length) is the size of the compressed data (source).