How Chromium Enforces HSTS Against Downgrade Attacks

This article explains the mechanisms the Chromium web browser uses to enforce HTTP Strict Transport Security (HSTS) and prevent protocol downgrade attacks. By leveraging dynamic policy caching, a hardcoded preload list, internal URL rewriting, and strict certificate validation, Chromium ensures that connections to secured websites remain encrypted. These defenses effectively neutralize man-in-the-middle (MitM) attempts to strip encryption and intercept sensitive user data.

The Threat of Protocol Downgrade Attacks

In a typical protocol downgrade attack, such as SSL stripping, an attacker intercepts a user's initial unencrypted HTTP request before the web server can redirect the browser to a secure HTTPS connection. The attacker then acts as a proxy, maintaining an encrypted connection with the server while communicating with the user's browser over unencrypted HTTP. Chromium’s implementation of HSTS stops this by ensuring the browser never sends an unencrypted HTTP request to a known secure host in the first place.

Dynamic HSTS Policy Caching

Chromium relies on the Strict-Transport-Security HTTP response header to dynamically learn which websites require strict encryption. When a user connects to a website via HTTPS, Chromium inspects the server's response headers. If the HSTS header is present, Chromium records the domain in a local security database, provided the connection has no TLS/SSL errors.

Chromium enforces two main directives from this header:

• max-age: This tells Chromium how long, in seconds, to remember that the domain must only be accessed using HTTPS. Each time the browser sees the header, it refreshes this expiration timer.
• includeSubDomains: When this optional flag is present, Chromium applies the HSTS policy to the root domain and all of its subdomains.

For security reasons, Chromium completely ignores HSTS headers delivered over unencrypted HTTP or over HTTPS connections with invalid certificates. This prevents attackers from manipulating HSTS policies.

Internal URL Rewriting (307 Redirects)

Once a domain is logged in Chromium's local HSTS database, the browser modifies how its network stack handles requests to that host. If a user types an http:// address into the omnibox, or clicks an insecure http:// link pointing to an HSTS-enabled domain, Chromium intercepts the request.

Before a single packet is sent over the local network, Chromium generates an internal 307 Internal Redirect. This operation silently rewrites the URL from http:// to https:// inside the browser. Because the unencrypted request never leaves the user's device, an attacker on the network cannot intercept or downgrade the connection.

The HSTS Preload List

Dynamic HSTS caching leaves one major vulnerability: the very first time a user visits a website, Chromium does not yet know the site uses HSTS. An attacker could exploit this initial HTTP connection before the browser receives the HSTS header.

To solve this "first visit" problem, Chromium maintains the HSTS Preload List. Website administrators can submit their domains to this project. Chromium hardcodes this massive list of domains directly into the browser's source code and updates it with each new browser release. For any domain on the preload list, Chromium enforces HTTPS by default, even if the user has never visited the website before.

Non-Bypassable Certificate Errors

Protocol downgrade attacks often go hand-in-hand with active interception, where an attacker presents a fraudulent or self-signed TLS certificate to the user. On a standard website, Chromium displays a warning screen when it detects a certificate error, but it allows the user to click "Advanced" and proceed to the unsafe site anyway.

When HSTS is active for a domain, Chromium strictly revokes the user's ability to bypass certificate warnings. If a certificate is expired, mismatched, or self-signed, Chromium blocks access to the site entirely and removes the option to proceed. This guarantees that users cannot accidentally expose themselves to an attacker who is attempting to spoof an HSTS-protected website.