I learned about this years ago and don't remember enough of the keywords to search for it appropriately.
Its where sites can tell the browser that the site must not allow the site to be downgraded to HTTP.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
This is the keyword you are looking for. If that's all you care about, then I'm happy I could help. However, if you would like to know why this is done, please keep reading.
This is the simplest form of ensuring your users only use HTTPs. Once a HTTP URL is requested, the server replies with a 301 response, redirecting the browser to the HTTPS location instead.
However, this means that whenever a client requests the HTTP site (potentially, whenever they want to go to your site via e.g. a bookmark), they can be intercepted by an attacker and potentially never redirected.
Attack Surface: Whenever they connect via HTTP.
In order to alleviate this, the HSTS system was developed. It works as follows: Every browser that supports HSTS has a HSTS cache. When a user tries to navigate to a domain via HTTP for which a HSTS entry is present, the request is automatically changed to HTTPS. So even if I explicitly typed
http://example.com, my browser would request
https://example.com (as long as
example.com was in my HSTS cache).
How do sites signify that they support HSTS? By placing a HTTP response header into every request. While technically it's not necessary to do so for every request, the downsides are minimal. The header looks like this:
The "max-age" parameter defines how long this request should be honored (in seconds). Typically a time of one year is chosen - although why this was done is anyone's guess. And while this is really nice and will protect your users on every subsequent visit, there is still the problem of when they first visit your site. After all, if they never visited your site, there is no way for them to know that you support HSTS. It's a chicken and egg problem. So the first time, there will still be a plaintext communication that can be intercepted.
Attack Surface: The first time they connect via HTTP.
So our goal now is to tell the user that we support HSTS without prior communication to the user. The solution is to use a so-called "preload list". The idea is simple: The website operator tells a list that they support HSTS and will continue to do so in the future.
The browser then gets this information1 through an already secure connection. As such, browsers will be able to know whether or not they should use HTTPS exclusively without ever having to communicate in plaintext.
Attack Surface: None.
I actually don't know if browsers regularly download the whole preload list or if they query individual domains. Turns out browsers get a new copy of the HSTS preload list whenever the browser is updated.