Strict-Transport-Security (HSTS)

HSTS tells a browser to access a site only through HTTPS for a specified period. It helps prevent HTTP downgrade and SSL-stripping attacks by causing eligible HTTP requests to be upgraded to HTTPS before they are sent.

A server enables HSTS by returning the `Strict-Transport-Security` response header over a secure HTTPS connection. A typical value is `max-age=31536000`, which tells the browser how many seconds the policy should remain active.

While the policy is active, the browser treats HTTP URLs for that host as HTTPS URLs. This can protect against an attacker who attempts to intercept an initial HTTP request and keep the connection in plaintext.

HSTS is primarily a browser-enforced policy. A backend application can send the header, but the user agent decides how to enforce it. The header should be delivered over HTTPS; browsers ignore HSTS received over an insecure HTTP connection.

The `includeSubDomains` directive extends the policy to subdomains. The optional `preload` directive signals an intention to be included in browser-maintained preload lists, but preloading has separate eligibility and operational requirements.

HSTS does not replace TLS configuration, certificate validation, secure cookies, authentication controls, or authorization. It specifically addresses the risk of using HTTP when HTTPS is required.

Key points

• HSTS forces eligible browser requests to use HTTPS for a host.
• The policy is configured with the `Strict-Transport-Security` response header.
• `max-age` specifies the policy lifetime in seconds.
• `includeSubDomains` extends enforcement to subdomains.
• HSTS must be learned through HTTPS; HTTP-delivered HSTS is not trusted.
• HSTS helps prevent downgrade and SSL-stripping attacks but does not replace TLS security.

Interview questions

What does `max-age=31536000` mean in an HSTS header?

`max-age` specifies how long the browser should remember the HSTS policy, measured in seconds. A value of `31536000` represents one year. During that period, the browser applies the site's HSTS policy to relevant requests. The duration is a client-side policy lifetime, not a TLS certificate lifetime.

Why doesn't HSTS sent over HTTP provide the same protection?

An attacker capable of interfering with an HTTP connection could also modify or remove an HSTS header delivered through that connection. Therefore, browsers do not accept HSTS policy updates received over insecure HTTP. The policy is established through a valid HTTPS connection. This prevents an attacker from using the insecure channel to weaken the security policy.

What is HSTS and why is it used?

HSTS stands for HTTP Strict Transport Security. A website sends the `Strict-Transport-Security` header over HTTPS to tell compatible browsers to use HTTPS for that host for a defined period. This reduces the risk of protocol-downgrade and SSL-stripping attacks. It is a browser policy rather than an encryption mechanism itself.

What is the difference between HSTS and an HTTP-to-HTTPS redirect?

A redirect is a server response that tells the browser to request an HTTPS URL after the initial HTTP request reaches the server. HSTS changes browser behavior so that, while the policy is active, the browser upgrades applicable HTTP URLs to HTTPS before making the insecure request. This distinction matters because the initial plaintext request is the exposure that an SSL-stripping attack can exploit. HSTS therefore provides protection that a redirect alone cannot provide.

What should you consider before enabling `includeSubDomains`?

`includeSubDomains` applies the HSTS policy to subdomains as well as the main host. Before enabling it, every affected subdomain should be capable of serving HTTPS reliably, including legacy or operational endpoints that may be overlooked. Otherwise, users can lose access to those hosts while the policy is active. The decision should therefore account for the complete subdomain inventory and certificate and deployment readiness.