Captive Portals don't load because of HSTS

Ask Fedora
, , ,
1

I’m using Fedora KDE Plasma Edition, and on networks requiring a captive portal for internet access, I get a notification telling me I should open a website to log in to the network, but the site never loads in my browser. I think this is because of HSTS:

In Fedoras default NetworkManager config (/lib/NetworkManager/conf.d/20-connectivity-fedora.conf) the connectivity check URI is uri=http://fedoraproject.org/static/hotspot.txt, however fedoraproject.org sets an HSTS header, so if a user ever visits this site in their browser, and then connects to a network requiring a captive portal (I noticed this on Deutsche Bahns train WiFi) the captive portal won’t load because the browser doesn’t downgrade the connection to HTTP, so the network can never inject the captive portal.

I don’t think disabling HSTS for fedoraproject.org is a good idea, but maybe moving the connectivity check to a subdomain which doesn’t set HSTS headers is a good alternative?

3

Firefox has some features related to captive portals. If you access “about:config” you can search for “captive” and see what the settings are. Supposedly captive detection is enabled by default, but I have no experience using it.

The captive portal setting in NetworkManager might work with the desktop, but how that works is poorly documented, if at all.

5

Yes, the captive portal detection in Firefox works (this is currently what I’m doing as a substitute). Firefox tries to contact detectportal.firefox.com, which doesn’t do HSTS. Also it is exempt by default from Firefox HTTPs-only setting (which disables the warning when HTTPs-only mode is enabled).

NetworkManagers captive portal detection works, but captive portal sign in doesn’t. Neither in Firefox, or in other browsers (e. g. Chrome). I don’t think there is a way to fix this without disabling HSTS (not recommended, not sure if it’s even possible), or have a separate domain for connectivity checks (without HSTS).

Also I just noticed that the HSTS header on fedoraproject.org includes subdomains, so I guess one would have to use a different domain altogether to fix this issue.

Edit: For an immediate solution I guess you could change the URI in NetworkManagers config to a site without HSTS, e. g. detectportal.firefox.com or neverssl.com. That site could start logging your requests, so there is some trust involved.