If multiple Strict-Transport-Security headers are set with different settings (e.g. different max-age values), how will the browser behave? Does the browser just follow one of them, or simply error out and discard all? Is this behaviour different across various browsers?

New contributor
One Oasis is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

According to RFC 6797, 8.1, the browser must only process the first header:

If a UA receives more than one STS header field in an HTTP response message over secure transport, then the UA MUST process only the first such header field.

  • 3
    It should be noted that this is the standard and a standard-conformant client will behave this way, there is no guarantee that the browsers in the real world actually conform to the standard perfectly. – MechMK1 Feb 22 at 9:21

Your Answer

One Oasis is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.