Mixing
HSTS vs RewriteRule
Clash Royale CLAN TAG#URR8PPP
up vote
1
down vote
favorite
I've recently read that HSTS is designed to avoid some of the vulnerabilities associated with htaccess redirects to force HTTPS, because the browser can be made to ignore them. That said, many of our websites force HTTPS via the following RewriteRule:
RewriteEngine On
RewriteCond %HTTPS off
RewriteRule ^(.*)$ https://%HTTP_HOST%REQUEST_URI [L,R=301]
My question is: are RewriteRules subject to the same general vulnerability as redirects, or are they a comparably safe alternative to HSTS?
tls hsts htaccess
asked 4 hours ago
Nosajimiki
1586
add a comment |Â
up vote
1
down vote
favorite
I've recently read that HSTS is designed to avoid some of the vulnerabilities associated with htaccess redirects to force HTTPS, because the browser can be made to ignore them. That said, many of our websites force HTTPS via the following RewriteRule:
RewriteEngine On
RewriteCond %HTTPS off
RewriteRule ^(.*)$ https://%HTTP_HOST%REQUEST_URI [L,R=301]
My question is: are RewriteRules subject to the same general vulnerability as redirects, or are they a comparably safe alternative to HSTS?
tls hsts htaccess
asked 4 hours ago
Nosajimiki
1586
add a comment |Â
up vote
1
down vote
favorite
up vote
1
down vote
favorite
I've recently read that HSTS is designed to avoid some of the vulnerabilities associated with htaccess redirects to force HTTPS, because the browser can be made to ignore them. That said, many of our websites force HTTPS via the following RewriteRule:
RewriteEngine On
RewriteCond %HTTPS off
RewriteRule ^(.*)$ https://%HTTP_HOST%REQUEST_URI [L,R=301]
My question is: are RewriteRules subject to the same general vulnerability as redirects, or are they a comparably safe alternative to HSTS?
tls hsts htaccess
asked 4 hours ago
Nosajimiki
1586
I've recently read that HSTS is designed to avoid some of the vulnerabilities associated with htaccess redirects to force HTTPS, because the browser can be made to ignore them. That said, many of our websites force HTTPS via the following RewriteRule:
RewriteEngine On
RewriteCond %HTTPS off
RewriteRule ^(.*)$ https://%HTTP_HOST%REQUEST_URI [L,R=301]
My question is: are RewriteRules subject to the same general vulnerability as redirects, or are they a comparably safe alternative to HSTS?
tls hsts htaccess
tls hsts htaccess
asked 4 hours ago
Nosajimiki
1586
asked 4 hours ago
Nosajimiki
1586
asked 4 hours ago
Nosajimiki
1586
asked 4 hours ago
Nosajimiki
1586
asked 4 hours ago
Nosajimiki
1586
1586
add a comment |Â
add a comment |Â
1 Answer
1
active
oldest
votes
up vote
5
down vote
accepted
No, a rewrite rule is still vulnerable to attacks like sslstrip.
If you look at the documentation or try it out, you'll see that your rewrite rule is actually creating a redirect.
answered 4 hours ago
AndrolGenhald
8,03941728
add a comment |Â
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
5
down vote
accepted
No, a rewrite rule is still vulnerable to attacks like sslstrip.
If you look at the documentation or try it out, you'll see that your rewrite rule is actually creating a redirect.
answered 4 hours ago
AndrolGenhald
8,03941728
add a comment |Â
up vote
5
down vote
accepted
No, a rewrite rule is still vulnerable to attacks like sslstrip.
If you look at the documentation or try it out, you'll see that your rewrite rule is actually creating a redirect.
answered 4 hours ago
AndrolGenhald
8,03941728
add a comment |Â
up vote
5
down vote
accepted
up vote
5
down vote
accepted
No, a rewrite rule is still vulnerable to attacks like sslstrip.
If you look at the documentation or try it out, you'll see that your rewrite rule is actually creating a redirect.
answered 4 hours ago
AndrolGenhald
8,03941728
No, a rewrite rule is still vulnerable to attacks like sslstrip.
If you look at the documentation or try it out, you'll see that your rewrite rule is actually creating a redirect.
answered 4 hours ago
AndrolGenhald
8,03941728
answered 4 hours ago
AndrolGenhald
8,03941728
answered 4 hours ago
AndrolGenhald
8,03941728
answered 4 hours ago
AndrolGenhald
8,03941728
8,03941728
add a comment |Â
add a comment |Â
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f196863%2fhsts-vs-rewriterule%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
