Search code examples
securitysslsafariman-in-the-middle

Securing web server against MITM attack in Safari

I have been looking for a way to make sure my web server is secure against a man in the middle attack. It does seem that Google Chrome and Firefox work in blocking requests to my server even if I select to advance after the security warning. I am testing this by using Charles Proxy to intercept Https traffic without having trusted the Charles Cert on my Mac.

When I run the same tests with Safari it will let me through if I chose to ignore the secure warning, which I expect a certain number of users to do. So it seems there is more configuration needed to lock down Safari traffic. I know this is possible because when trying to navigate to github.com with the same scenario I get the following message:

Safari Can't Open

Does anyone know what GitHub is doing to block Safari traffic on an untrusted connection?

Solution

  • Looks like Safari is supporting HSTS and that github is using it. Their HTTP response contains the following header:

    Strict-Transport-Security:max-age=31536000; includeSubdomains; preload

    This way a browser supporting HSTS knows that for the foreseeable time this site should only be visited with https and any attempts to use http only will automatically be upgraded by the browser.

    Apart from basic HSTS which only works after the first visit of the site github also adds the preload directive. This tells browser makers that github likes to be included in the preloaded HSTS list shipped with the browsers, so that the browser applies HSTS even if the site was never visited before by the user. See HSTS Preloading for more information.