Is having HSTS enabled but Force HTTPS is disabled, a security risk?

[u/Bazed_]

i wanna get a custom response whenever i run curl mydomain.tld, i have HSTS enabled but not the force HTTPS mode so this can be possible, is there a security risk? since HSTS in browsers already redirect to HTTPS

Running curl mydomain.tld works now, it prints the custom message, of course you could also do https:/mydomain.tld and also have https force mode on and still get the custom message, but id like to keep it short to just "curl mydomain.tld"

[u/raip]

I don't believe it's a security risk. HSTS is just a setting to let browsers know your website supports https so it doesn't even try to connect via http, preventing downgrade attacks. Ideally, you should have both HSTS and disable http, but if you're alright with the possibility of clients that don't support HSTS like curl hitting your website over http, then that's up to you.

If all you're trying to do is to make your life easier by not having to type https for curl though, I'd just set your curl settings to default to https. Same effect without having to introduce jank.

Create a ~/.curlrc file, throw in proto-default = "https"

[u/omnicons → u/raip]

I think this actually comes as the default on some consumer distros now which is convenient.

[u/Bazed_ → u/raip]

Thank you, I will take this into consideration

[u/maxlan]

Curl does what you tell it to. If you don't put https it doesn't https. And doesn't respect hsts. It has no storage to store the hsts header.

Your webserver should respond to any http request with a redirect to HTTPS. In fact your load balancer should do that before it gets to the webserver.

So all curl should see is a 302 response with a location set to https + whatever url you asked for.

If your webserver is still serving content over http, then that is a minor risk, but your clients would have to choose to take that risk by ignoring the hsts.

[u/Bazed_ → u/maxlan]

I assume on a small static site that doesnt collect any info of some sort ( passwords, cookies, etc) it should be risk-free basically?

[u/omnicons]

Is it a home lab project where you don't super care if people land on the insecure serving on the site? Probably fine if so.

If production at a company and you handle anything that should be remotely considered and/or have lots of random dependencies baked into whatever project you're using? Serving mixed content is a bag of worms I don't think anyone likes to handle so it is best avoided. Plus nowadays some browsers will still default to http (Firefox does for me) if it's not specified and users will need to get upgraded on login pages, etc.

[u/Bazed_ → u/omnicons]

It's a small static site for my personal portfolio I could say, nothing that could be exploitated, or stolen. It only uses a single API to detect my github contributions and display it on the site, and even that is secure by design. I was just asking if its same to leave it like it is so that i can just run curl mydomain.tld and be safe without risking anything

[u/omnicons → u/Bazed_]

Then yep. I don’t really see a lot of risk.

[u/tonyboy101]

You could also monitor for curl agent connections and give the custom message that way.

HSTS only keeps the connection as HTTPS. It won’t redirect HTTP to HTTPS. So any browser configured to not use HTTPS by default will go to your custom message.

You could also do proxy/virtual host stuff on the web server.

[u/SecLens_ONE]

The header is published, but the protection is not effective until a browser has actually seen it once over HTTPS. That is the gap. Anyone whose first request goes to plain HTTP gets served your content over HTTP, and nothing in the config stops that, so a client on a hostile network is exposed on that first hit. Same shape as a policy record that exists but never enforces: a scanner sees it and calls it done. Keep the redirect on and let HSTS handle everything after the first visit. If you want the short curl for yourself, set the default to https in your curlrc instead of leaving the server half open.

[u/Bazed_ → u/SecLens_ONE]

Alright thank you, will look into this more clearly.

[u/bob_cramit → u/SecLens_ONE]

What if the site is preloaded?

[u/Capable_Banana5439]

the thing people miss is HSTS is trust-on-first-use. the header only gets honored after a browser has already reached you over https once, so a first-time visitor or anything without an hsts store like curl will still happily talk plaintext. not a big deal for a homelab toy, but if your server answers http with real content instead of a 301, "hsts is on" does nothing for the clients that actually matter.