You are correct on both your first 2 points.
As a protection against attacks such as SSLstrip, the HSTS header
prevents an attacker from downgrading a connection from HTTPS to HTTP,
as long as the attributes of the header are properly configured.
Yes, so the HSTS header tells the browser to only access the web server over a secure connection, thereby rejecting connections over HTTP, and redirecting them to HTTPS.
However, HTTP/2, whilst not making encryption mandatory is implemented
with mandatory TLS connection in modern browsers, according to
Right, most of the major browsers will only support HTTP/2 over HTTPS.
In that case, is there any point in having the HSTS header enabled
when using HTTP/2? Can an attacker force the client to use HTTP/1 and
in turn SSLstrip the connection? Is HTTP/2 enough, does it make the HSTS header > obsolete?
The web server implementing HTTP/2 doesn't force a HTTPS connection.
It's just a browser requirement that HTTP/2 will only be supported over TLS.
HTTP/2 is defined both for HTTP URIs and for HTTPS URIs.
What happens when a user tries to load a website over HTTP?
HTTP/1.1 is the fallback protocol if HTTP/2 fails.
So, HTTP/2 enabled sites may still very much be vulnerable to a SSL-striping-MitM attacks.