Which HSTS preload list is used by which browser?

Question

I've been reading various informations about Google and Firefox using an HSTS preload list.

it seems that there is a generic list here : https://hstspreload.org/
and that Chrome uses the one from Chromium here : https://www.chromium.org/hsts/
and Firefox uses the one here : https://dxr.mozilla.org/comm-central/source/mozilla/security/manager/ssl/nsSTSPreloadList.inc

Does Safari or Opera use a HSTS preload list ? Which one ? What is the relationship between the 3 list cited above ?

Thank you

For example, the only TLD listed in Firefox is "google", but I can confirm that Safari is also using HSTS for dev, foo, page, app, chrome. — Josh Lee, Dec 14 '17 at 16:42

score 11 · Accepted Answer · answered Jan 14 '18 at 07:31

The defacto central master list for HSTS is managed by Chromium / Google at https://chromium.googlesource.com/chromium/src/net/+/master/http/transport_security_state_static.json .

A list of Browsers supporting HSTS (and presumably having preload lists) can be found at Wikipedia. Being closed source, information on how Opera, Safari, IE, etc. handle their preloaded lists seem to be unavailable.

The Microsoft Edge Team state in their Blog, that

Like other browsers which have implemented this feature, Microsoft Edge and Internet Explorer 11 base their preload list on the Chromium HSTS preload list.

For Firefox, the list at /source/mozilla/security/manager/ssl/nsSTSPreloadList.inc is generated by the file /source/mozilla/security/manager/tools/getHSTSPreloadList.js, where we can see from the line

const SOURCE = "https://chromium.googlesource.com/chromium/src/net/+/master/http/transport_security_state_static.json?format=TEXT";

that it is merely a clone of the "master list", parsed into Firefox` format. All it does is an additional verification run for each domain in the list to be available and have the required HSTS header (by connecting to it; which it seems to do daily, from the vcs log).

Palemoon follows this procedure and it is likely that other browser vendors do the same. So it seems the relationship between your lists is: there is only one.

Please change the URL for Google Chrome to the following: https://chromium.googlesource.com/chromium/src/+/main/net/http/transport_security_state_static.json Currently they are pointing to `main` branch instead of `master` Updating as I was looking for a solution to an issue and found your answer pointing to old file — Nauman Shah, Jul 28 '22 at 12:14

score 0 · Answer 2 · answered Dec 14 '17 at 19:18

0

From your first link:

Most major browsers (Chrome, Firefox, Opera, Safari, IE 11 and Edge) also have HSTS preload lists based on the Chrome list. (See the HSTS compatibility matrix.)

answered Dec 14 '17 at 19:18

Barry Pollard

40,655
7
76
92

Yes the question is more about what "based" means in the sentence above. Is it copied ? Inspired from ? Reviewed ? – Elvex Dec 14 '17 at 21:48
As I understand it, it’s integrated into the individual browsers lists every so often. – Barry Pollard Dec 14 '17 at 21:54
And individual browsers may add to that list too. – Barry Pollard Dec 14 '17 at 21:55

Which HSTS preload list is used by which browser?

2 Answers2

Linked