4

I have seen that websites automatically transform HTTP requests into HTTPS without the HTTP Strict Transport Security (HSTS) Header.

So does the following line in the request fully alleviate the need for HSTS?

Content-Security-Policy: upgrade-insecure-requests;
  • 1
    What is your question? – Sjoerd Jan 25 '18 at 7:42
7

From MDN:

The upgrade-insecure-requests directive will not ensure that users visiting your site via links on third-party sites will be upgraded to HTTPS for the top-level navigation and thus does not replace the Strict-Transport-Security (HSTS) header, which should still be set with an appropriate max-age to ensure that users are not subject to SSL stripping attacks.

3

upgrade-insecure-requests upgrades any http request to https when the page is loaded over https. This helps to avoid mixed content issue but will not force the page to be loaded over secure schema.

More details can be found on https://scotthelme.co.uk/migrating-from-http-to-https-ease-the-pain-with-csp-and-hsts/

3

They do different things. Content-Security-Policy: upgrade-insecure-requests affects your page's resources for a single session, including things linked to on other domains. HSTS affects your own domain, and your browser remembers it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.