I'm using HSTS(Strict-Transport-Security Header) for web applications. As far as I know browser keeps that information and when a user tries to connect to my website, browser loads it via HTTPS directly. So MITM attacks are prevented.

I also have a mobile application which talks with a web api via HTTPS. Should I implement HSTS header for that? My opinion is it won't provide any additional security since there is no browser which keeps that HSTS header information for web api. Am I correct?


You are correct. There would really be no point here. It would only be useful if somebody chooses to directly hit the api from a browser, but if there is no use case for that, then its not necessary.


Agree with Joe, the HSTS browser is useful for browsers since browsers know how to interpret it. A mobile application doesn't, unless you (or a framework) tells it to.

Furthermore, you probably have a hardcoded (https://foo/bar) URL in your application anyways, so it won't hit the service on any non-https connection. If the same API is used by a browser (SPA), that's a different story indeed - but for the sole purpose of a mobile app, it doesn't make a difference to have the HSTS header in there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.