Implement HSTS

[Ms2ger]

No description provided.

[frewsxcv]

Relevant section:

https://fetch.spec.whatwg.org/#main-fetch

Part of step 9:

Matching request’s current url’s host per Known HSTS Host Domain Name Matching results in either a superdomain match with an asserted includeSubDomains directive or a congruent match (with or without an asserted includeSubDomains directive) [HSTS]

[frewsxcv]

Related: #8580

[Darkspirit]

Please reopen. This issue was filed for the regression caused by #14360 (comment):
It removed the function that added received HSTS headers to the internal HSTS database. Since then, only Preloaded entries are applied. The PR that closed this issue did not add it back.

Only these cases are tested:

• upgrade http to https with a pre-defined HSTS database (Write a WPT test for STS headers #6921 was primarily about this)
• ignore HSTS header received via http

Not tested:

• HSTS header received via https is added to the internal database

Likely not tested:

• ws:// is upgraded to wss://
• HSTS header received via wss:// is added to the internal database

---

Originally I was just asking myself, if ws:// gets upgraded to wss:// by current code. It doesn't seem so.
https://fetch.spec.whatwg.org/#websocket-opening-handshake

This upgrades http to https:

servo/components/net/fetch/methods.rs

Lines 262 to 268 in 8002c6b

	// Step 10.
	context
	.state
	.hsts_list
	.read()
	.unwrap()
	.switch_known_hsts_host_domain_url_to_https(request.current_url_mut());

If websocket requests go through this function, ws to wss upgrades could be done here as well:

servo/components/net/hsts.rs

Lines 141 to 152 in f1dd31f

	/// Step 10 of https://fetch.spec.whatwg.org/#concept-main-fetch.
	pub fn switch_known_hsts_host_domain_url_to_https(&self, url: &mut ServoUrl) {
	if url.scheme() != "http" {
	return;
	}
	if url
	.domain()
	.map_or(false, |domain| self.is_host_secure(domain))
	{
	url.as_mut_url().set_scheme("https").unwrap();
	}
	}

Otherwise, a call to switch_known_hsts_host_domain_url_to_https() could be added after this code:

servo/components/net/websocket_loader.rs

Lines 195 to 201 in 8002c6b

	let scheme = req_builder.url.scheme();
	let mut req_url = req_builder.url.clone();
	if scheme == "ws" {
	req_url.as_mut_url().set_scheme("http").unwrap();
	} else if scheme == "wss" {
	req_url.as_mut_url().set_scheme("https").unwrap();
	}

[jdm]

Thanks for checking!

[Darkspirit]

Along this, it would be good to add these prefs to switch_known_hsts_host_domain_url_to_https():

• "network.enforce_https.enabled": false, with the following exceptions:
  • "network.enforce_https.localhost": false, (incl. loopback IPs)
  • "network.enforce_https.onion": false,

This would also address #20120. The same should be done for Firefox: bug 1335590

[Darkspirit]

@highfive assign me

[highfive]

Hey @Darkspirit! Thanks for your interest in working on this issue. It's now assigned to you!