Edit

Page

Page title:

Page body:

* 仕様書

[REFS[
- [6] [CITE@en[RFC 6797 - HTTP Strict Transport Security (HSTS)]]
( ([TIME[2014-06-02 05:16:10 +09:00]] 版))
<http://tools.ietf.org/html/rfc6797#section-12.3>
- [7] [CITE@en[Upgrade Insecure Requests]] ([TIME[2015-10-07 03:24:10 +09:00]] 版) <https://w3c.github.io/webappsec-upgrade-insecure-requests/#preloadable-hsts-host>
]REFS]

* 意味

[1] [[ホスト]]が [DFN[[[prelodable HSTS host]]]] であるとは、
[[既知HSTSホストドメイン名一致]]を適用した時、
[CODE[[[includeSubDomains]]]] [[指令]]と [CODE[[[preload]]]] [[指令]]の両方を含む[[既知HSTSホスト]]に[[超ドメイン一致]]するか、
[CODE[[[preload]]]] [[指令]]を含む[[既知HSTSホスト]]に[[合同一致]]することをいいます
[SRC[>>7]]。

* 実装

[FIG(quote)[
[FIGCAPTION[
[2] [CITE@en-US[HTTP Strict Transport Security - Web security | MDN]]
([TIME[2015-02-20 08:29:03 +09:00]] 版)
<https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security>
]FIGCAPTION]

:preload Optional:
See Preloading Strict Transport Security for details. Not part of the specification.

]FIG]

[FIG(quote)[
[FIGCAPTION[
[3] [CITE[HSTS Preload Submission]]
([TIME[2015-03-11 18:29:44 +09:00]] 版)
<https://hstspreload.appspot.com/>
]FIGCAPTION]

> Note that the preload flag in the HSTS header is required to confirm and authenticate your submission to the preload list. An example valid HSTS header:
> Strict-Transport-Security: max-age=10886400; includeSubDomains; preload

]FIG]

[4] [CITE[http/transport_security_state_static.json - chromium/src/net - Git at Google]]
([TIME[2015-04-17 16:56:41 +09:00]] 版)
<https://chromium.googlesource.com/chromium/src/net/+/master/http/transport_security_state_static.json>

[5] 意味もわからず [[HSTS Preload]] に登録して、サブドメインに接続できなくなったなどと困っている人もいるようです。
[CODE[includeSubDomains]] と [CODE[preload]] をヘッダーに明示的に指定しないとそうはならないはずですから、
どこかの解説サイトから理解せずにコピペして登録したのですかね。。。

[8] [CITE[#16584 (HSTS preload list out of date?) – Tor Bug Tracker & Wiki]]
([TIME[2015-12-15 19:54:34 +09:00]] 版)
<https://trac.torproject.org/projects/tor/ticket/16584>

[9] [CITE@en-US[nsSTSPreloadList.inc - DXR]]
([TIME[2015-12-15 19:54:51 +09:00]] 版)
<https://dxr.mozilla.org/mozilla-central/source/security/manager/ssl/nsSTSPreloadList.inc>

[FIG(quote)[
[FIGCAPTION[
[10] [CITE[HSTS Preload List Submission]]
([TIME[2017-06-10 08:11:12 +09:00]])
<https://hstspreload.org/>
]FIGCAPTION]

> If you maintain a project that provides HTTPS configuration advice or provides an option to enable HSTS, do not include the preload directive by default. We get regular emails from site operators who tried out HSTS this way, only to find themselves on the preload list by the time they find they need to remove HSTS to access certain subdomains.

]FIG]

[FIG(quote)[
[FIGCAPTION[
[11] [CITE@en-US[Preloading HSTS | Mozilla Security Blog]]
([TIME[2017-06-12 21:28:08 +09:00]])
<https://blog.mozilla.org/security/2012/11/01/preloading-hsts/>
]FIGCAPTION]

> We limit the list to hosts that send a large max-age under the assumption that these sites will not revert to non-HSTS status. However, this may become necessary. Suppose ownership of a domain on the preload list is transferred and the new owner decides to no longer use HSTS. The HSTS spec allows the site to send a header with the directive “max-age=0”. This indicates that HSTS should not be enforced for that host, and the browser would honor this. The preload list must replicate this behavior.

> To accomplish this task, we introduce the concept of “knockout” entries in our HSTS implementation. When the browser receives an HSTS header with “max-age=0”, a knockout entry is stored that overrides the corresponding entry in the preload list. The knockout entry essentially says, “We have no HSTS information regarding this host.” As a result, the browser behaves as if the host were not on the preload list.

]FIG]

[55] [CITE@ja[Google Developers Japan: ウェブ上の安全なアプリのホーム、.app のご紹介]]
([TIME[2018-05-08 16:14:17 +09:00]])
<https://developers-jp.googleblog.com/2018/05/introducing-app-more-secure-home-for.html>

[12] [CITE@en[853934 - Some captive portals are using 1.1.1.1 and breaking because it's HSTS preloaded - chromium - Monorail]]
([TIME[2018-07-06 15:06:35 +09:00]])
<https://bugs.chromium.org/p/chromium/issues/detail?id=853934>

[13] [CITE@en[net/http/transport_security_state_static.json - chromium/src - Git at Google]]
([TIME[2018-09-22 15:55:55 +09:00]])
<https://chromium.googlesource.com/chromium/src/+/master/net/http/transport_security_state_static.json>

[14] [CITE@en[chromium/hstspreload.org: Chromium's HSTS preload list submission website.]]
([TIME[2019-02-27 11:16:56 +09:00]])
<https://github.com/chromium/hstspreload.org>

[15] [CITE@en[chromium/hstspreload: 🔒🔍 A Go package to scan sites against requirements for Chromium-maintained HSTS preload list.]]
([TIME[2019-02-27 11:17:36 +09:00]])
<https://github.com/chromium/hstspreload>

Historical Legal Sensitive Parent: [Help / License]

Edit

Page

Page name(s)