I have an application that is protected by Cloudflare. The application responds with a HSTS on all of the other pages except HTTP status 403 Forbidden and 302 Moved Temporarily. It seems to be Cloudflare is responsible for it. There are also some resources (JS) that does not have the HSTS applied, but that is off-topic for this question.

My intuition says that all pages (and resources) needs to have HSTS because, while unlikely, someone mistyped the url and induced a forbidden it would be vulnerable to attacks like sslstrip.

  • This is specified by the RFC. Only 2xx pages are allowed to use the headers (IIRC).
    – forest
    Jul 15, 2018 at 0:45
  • 2
    @forest I skimmed the RFC and didn't see any mention of that. I only see "An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport." Jul 27, 2018 at 14:01
  • @AndrolGenhald Huh, I guess you're right. I wonder where that memory came from...
    – forest
    Jul 29, 2018 at 2:37

1 Answer 1


While it's not good, and it should be fixed, it's likely not as bad as you think. HSTS applies to domains, so as soon as one response includes the Strict-Transport-Security header the browser will force all requests to redirect to HTTPS for the entire domain (and possibly subdomains, depending on configuration).

Resources like JavaScript and CSS are rarely if ever accessed directly by end-users, so the HSTS header should be received before these resources are requested anyway.

If there is a MitM and the user hasn't visited the site before (or the max-age of the HSTS header has passed) and the site isn't in the preload list, it won't matter that some responses include it and some don't; the MitM can use ssl-strip either way. HSTS only works after the browser has seen it, if you're visiting a site for the first time over HTTP you're vulnerable unless it's in the preload list.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .