Securing the Web with HSTS-Enforced

• URL: http://arxiv.org/abs/2605.04642v1
• Date: Wed, 06 May 2026 08:33:12 GMT
• Title: Securing the Web with HSTS-Enforced
• Abstract summary: TLS stripping attacks expose sensitive web traffic by forcing secure HTTPS connections to fall back to unencrypted HTTP.<n> protection against these attacks relies on website operators explicitly opting into security by deploying mechanisms such as HTTP Strict Transport Security (HSTS) headers.<n>We introduce HSTS-Enforced, a mechanism that eliminates the remaining attack surface for TLS stripping while still allowing operators to securely specify that their websites need to be accessed over HTTP.
• Score: 42.091774598477706
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: TLS stripping attacks expose sensitive web traffic by forcing secure HTTPS connections to fall back to unencrypted HTTP. At present, protection against these attacks relies on website operators explicitly opting into security by deploying mechanisms such as HTTP Strict Transport Security (HSTS) headers. These mechanisms have significant limitations: some are weak or difficult to configure, which raises the risk of misconfiguration and reduces practical adoption; others violate HTTP backward compatibility; at least one can even be abused to enable unintended user tracking. We introduce HSTS-Enforced, a mechanism that eliminates the remaining attack surface for TLS stripping while still allowing operators to securely specify that their websites need to be accessed over HTTP when necessary, thereby maintaining accessibility. To achieve this, we flip the current opt-in security model to an opt-out model: all connections default to HTTPS, and operators can explicitly opt out if their websites require HTTP using so-called HTTP-Required indicators. We propose two such HTTP-Required indicators: a new DNS record and an HTTP-Required Preload list. We evaluate HSTS-Enforced under multiple deployment scenarios, demonstrating that it blocks all practical TLS stripping attempts while maintaining compatibility for sites that require HTTP - without introducing overhead in the typical case. Finally, we outline a practical transition path to accelerate global adoption.

Related papers

• Understanding the Privacy-Preserving Potential of HTTP/2 Against Webpage Fingerprinting [13.246544338987414]
  Website fingerprinting (WF) attacks can infer which webpage a user visits from encrypted HTTPS traffic alone.<n>WF defenses commonly shape traffic through noise, padding, delays, or flow splitting.<n>We focus on application-layer defenses enabled by the most widely deployed version of HTTP, HTTP/2.
  arXiv  Detail & Related papers  (2026-09-04T13:16:30Z)
• CDN Tsunami: Exploiting HTTP/3-HTTP/1.1 Conversion for DoS Attacks [39.862345027090534]
  We study the first study of DoS attacks against HTTP/3 protocols deployed at CDNs.<n>Our key insight is that when the CDN adopts HTTP/3 but the host websites use HTTP/1.1, an adversary can utilize the disparity to amplify a small amount of traffic to the CDN.<n>We conduct a large-scale measurement upon the Tranco Top 1M domain list to quantify the real-world impact of these attacks.
  arXiv  Detail & Related papers  (2026-07-29T08:09:36Z)
• HyperSafe: Inference-Time Safety Recovery for Fine-Tuned Language Models [65.08794811632073]
  HyperSafe restores safety behavior by generating a model-specific Safe Side Network for each fine-tuned checkpoint.<n>We evaluate HyperSafe on two model families, Qwen2-7B and LLaMA-3-8B, across multiple safety benchmarks.
  arXiv  Detail & Related papers  (2026-07-13T12:28:43Z)
• SST-Guard: Detecting and Characterizing Server-Side Google Analytics in the Wild [48.894149803432605]
  We present SST-Guard, a browser-based system for detecting and blocking server-side Google Analytics (sGA)<n>SST-Guard aims to detect underlying artifacts of collection and sharing of these semantic values to any arbitrary endpoint.<n>We validate SST-Guard on Tranco top-10k websites, detecting 4.02% (403) sGA domains with over 93% accuracy across three modalities.
  arXiv  Detail & Related papers  (2026-04-30T06:50:14Z)
• HTTP Request Synchronization Defeats Discrepancy Attacks [6.113912479606383]
  We propose the first comprehensive defense to address this problem, called HTTP Request Synchronization.<n>Our scheme uses standard HTTP extension mechanisms to augment each request with a complete processing history.<n>Using this history, every proxy server can validate that their processing is consistent with all previous hops, eliminating discrepancy attacks.
  arXiv  Detail & Related papers  (2025-10-11T01:42:38Z)
• Defending Against Prompt Injection With a Few DefensiveTokens [44.221727642687085]
  Large language model (LLM) systems interact with external data to perform complex tasks.<n>By injecting instructions into the data accessed by the system, an attacker can override the initial user task with an arbitrary task directed by the attacker.<n>Test-time defenses, e.g., defensive prompting, have been proposed for system developers to attain security only when needed in a flexible manner.<n>We propose DefensiveToken, a test-time defense with prompt injection comparable to training-time alternatives.
  arXiv  Detail & Related papers  (2025-07-10T17:51:05Z)
• Streamlining HTTP Flooding Attack Detection through Incremental Feature Selection [0.3277163122167433]
  In this paper, a method for the detection of such an attack is proposed.<n> INFS-MICC helps in identifying a subset of highly relevant and independent feature subset.
  arXiv  Detail & Related papers  (2025-05-20T06:19:03Z)
• ChatHTTPFuzz: Large Language Model-Assisted IoT HTTP Fuzzing [18.095573835226787]
  Internet of Things (IoT) devices offer convenience through web interfaces, web VPNs, and other web-based services, all relying on the HTTP protocol. Most state-of-the-art tools still rely on random mutation trategies, leading to difficulties in accurately understanding the HTTP protocol's structure and generating many invalid test cases. We propose a novel LLM-guided IoT HTTP fuzzing method, ChatHTTPFuzz, which automatically parses protocol fields and analyzes service code logic to generate protocol-compliant test cases.
  arXiv  Detail & Related papers  (2024-11-18T10:48:53Z)
• Securing the Web: Analysis of HTTP Security Headers in Popular Global Websites [2.7039386580759666]
  Over half of the websites examined (55.66%) received a dismal security grade of 'F' These low scores expose multiple issues such as weak implementation of Content Security Policies (CSP), neglect of HSTS guidelines, and insufficient application of Subresource Integrity (SRI)
  arXiv  Detail & Related papers  (2024-10-19T01:03:59Z)
• The HTTP Garden: Discovering Parsing Vulnerabilities in HTTP/1.1 Implementations by Differential Fuzzing of Request Streams [7.012240324005978]
  HTTP/1.1 parsing discrepancies have been the basis for numerous classes of attacks against web servers. Our system, the HTTP Garden, examines both origin servers' interpretations and gateway servers' transformations of HTTP requests. Using our tool, we have discovered and reported over 100 HTTP parsing bugs in popular web servers, of which 68 have been fixed following our reports.
  arXiv  Detail & Related papers  (2024-05-28T01:48:05Z)
• EmInspector: Combating Backdoor Attacks in Federated Self-Supervised Learning Through Embedding Inspection [53.25863925815954]
  Federated self-supervised learning (FSSL) has emerged as a promising paradigm that enables the exploitation of clients' vast amounts of unlabeled data. While FSSL offers advantages, its susceptibility to backdoor attacks has not been investigated. We propose the Embedding Inspector (EmInspector) that detects malicious clients by inspecting the embedding space of local models.
  arXiv  Detail & Related papers  (2024-05-21T06:14:49Z)
• Model Supply Chain Poisoning: Backdooring Pre-trained Models via Embedding Indistinguishability [61.549465258257115]
  We propose a novel and severer backdoor attack, TransTroj, which enables the backdoors embedded in PTMs to efficiently transfer in the model supply chain.<n> Experimental results show that our method significantly outperforms SOTA task-agnostic backdoor attacks.
  arXiv  Detail & Related papers  (2024-01-29T04:35:48Z)
• An Embarrassingly Simple Backdoor Attack on Self-supervised Learning [52.28670953101126]
  Self-supervised learning (SSL) is capable of learning high-quality representations of complex data without relying on labels. We study the inherent vulnerability of SSL to backdoor attacks.
  arXiv  Detail & Related papers  (2022-10-13T20:39:21Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.