HSTS not working with Chrome
I have configured Apache to return HSTS header. When connecting to https://lab20.example.com from Google Chrome and running with developer tools I can see the following response header: Strict-Transport-Security:max-age=63072000; includeSubdomains;
But it does not work. When I try to access the http://lab20.example.com, Chrome allows that.
Also when running from chrome: chrome://net-internals/#hsts Query domain "lab20.example.com"
I receive "Response Not found".
Could anyone explain why this happens?
For others who are seeing a similar issue - it may be because your browser has not yet accessed the site over HTTPS. Try accessing it over HTTPS and then again over HTTP. If HSTS is correctly implemented, then that last request should fail. MDN explains it nicely:
Note: The
Strict-Transport-Security
header is ignored by the browser when your site is accessed usingHTTP
; this is because an attacker may interceptHTTP
connections and inject the header or remove it. When your site is accessed overHTTPS
with no certificate errors, the browser knows your site isHTTPS
capable and will honor theStrict-Transport-Security
header.