I'm using HSTS(Strict-Transport-Security Header) for web applications. As far as I know browser keeps that information and when a user tries to connect to my website, browser loads it via HTTPS directly. So MITM attacks are prevented.

I also have a mobile application which talks with a web api via HTTPS. Should I implement HSTS header for that? My opinion is it won't provide any additional security since there is no browser which keeps that HSTS header information for web api. Am I correct?

2 Answers 2


You are correct. There would really be no point here. It would only be useful if somebody chooses to directly hit the api from a browser, but if there is no use case for that, then its not necessary.


Agree with Joe, the HSTS browser is useful for browsers since browsers know how to interpret it. A mobile application doesn't, unless you (or a framework) tells it to.

Furthermore, you probably have a hardcoded (https://foo/bar) URL in your application anyways, so it won't hit the service on any non-https connection. If the same API is used by a browser (SPA), that's a different story indeed - but for the sole purpose of a mobile app, it doesn't make a difference to have the HSTS header in there.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .