11

I have seen that websites automatically transform HTTP requests into HTTPS without the HTTP Strict Transport Security (HSTS) Header.

So does the following line in the request fully alleviate the need for HSTS?

Content-Security-Policy: upgrade-insecure-requests;
Improve this question
1
  • 1
    What is your question?
    – Sjoerd
    Commented Jan 25, 2018 at 7:42

3 Answers 3

Reset to default
11

From MDN:

The upgrade-insecure-requests directive will not ensure that users visiting your site via links on third-party sites will be upgraded to HTTPS for the top-level navigation and thus does not replace the Strict-Transport-Security (HSTS) header, which should still be set with an appropriate max-age to ensure that users are not subject to SSL stripping attacks.

Improve this answer
5

upgrade-insecure-requests upgrades any http request to https when the page is loaded over https. This helps to avoid mixed content issue but will not force the page to be loaded over secure schema.

More details can be found on https://scotthelme.co.uk/migrating-from-http-to-https-ease-the-pain-with-csp-and-hsts/

Improve this answer
3

They do different things. Content-Security-Policy: upgrade-insecure-requests affects your page's resources for only a single session, including things linked to on other domains. HSTS affects your own domain, and the user's browser remembers it for longer than a single session.

Improve this answer
2
  • your and your do not refer to the same person. If you set the HSTS header for your own domain, requests from visitors will be upgraded and their browser will remember to do this for all _their subsequent requests to any resource on your domain, for a specified max-age.
    – R. Schreurs
    Commented May 3, 2022 at 10:15
  • 1
    Oh yeah I used one too many "your"s. I've tweaked the wording now.
    – Macil
    Commented May 4, 2022 at 20:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .