5

Let's assume that I have correctly configured my server to enforce the HSTS policy, and it works correctly for IE 11 browsers. What happens when a someone using an unsupported browser (e.g., IE 9) tries to access the site? What will the server do, and what will the user see? Is there a process/procedure to "gracefully" handle the condition of an unsupported browser accessing an HSTS site?

Improve this question

1 Answer 1

Reset to default
7

The only thing the server does when it comes to HSTS is sending the Strict-Transport-Security header. Enforcing the policy - keeping track of which domain has HSTS, when it expires, making sure these are only accessed with HTTPS, etc. - is entierly the responsibility of the client (e.g. the browser).

So what happends when a non supporting browser visits a HSTS site? The browser sees a header it doesn't recognise, so it doesn't do anything with it. Then it continues doing what a browser does as if nothing happend. Of course the user of such a browser does not get any protection, but they don't get any compatibility problems either.

So there are no compatibility issues with HSTS, and you don't need to do anything extra for older browsers.

Improve this answer
1
  • Correct. HTTP user-agents (i.e. browsers) ignore HTTP headers that they don't recognize. This is why it's also safe to send X-Frame-Options to pre-IE8 browsers, or Content-Security-Policy to browsers that don't implement CSP (mostly IE), etc.
    – CBHacking
    Sep 19, 2016 at 18:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .