Technical Tip: Determine if an URL is using HTTP Strict Security (HSTS)

[jballini]

Description	This article describes how can be determined if a website is using HTTP Strict Transport Security (HSTS). The way HTTP Strict Transport Security (HSTS) works is that a website using HSTS will forcibly connect to itself only over HTTPS by instructing the browser to communicate with it only via encrypted connections. It means the website enforces secure communication, and any attempt to intercept and inspect the traffic-as done in SSL deep inspection-would break the secure connection and trigger browser warnings or errors. This can cause connectivity issues or even security warnings on the browser: enabling SSL deep inspection on an HSTS-enabled website conflicts with the secure connection enforced by HSTS because of the decryption-inspection-encryption process attempted by the firewall.
Scope	FortiGate.
Solution	To determine if an URL is using HTTP Strict Transport Security (HSTS), the following steps can be performed: Open a web browser on a computer within the network where the issue is occurring.                                           Visit the website (for instance fortinet.com).   Once the website loads, 'right-click' anywhere on the page and select 'Inspect' or press F12 to open the Developer Tools.                                                                                                                                                                                                                                                                                                                                    In the Developer Tools Window, navigate to the 'Network' tab.                                                                                                                                                                                                                                                                                                                                                                                                           Look for the request to the website (fortinet.com) in the list of network requests. The request should have a column labeled 'Response Headers'.                                                                                                                                                                                                                                                                                                    In the 'Response Headers' section, look for the header 'Strict-Transport-Security'. If this header is present and specifies a time duration, it indicates that the website is using HSTS.