If multiple Strict-Transport-Security headers are set with different settings (e.g. different max-age values), how will the browser behave? Does the browser just follow one of them, or simply error out and discard all? Is this behaviour different across various browsers?


According to RFC 6797, 8.1, the browser must only process the first header:

If a UA receives more than one STS header field in an HTTP response message over secure transport, then the UA MUST process only the first such header field.

  • 3
    It should be noted that this is the standard and a standard-conformant client will behave this way, there is no guarantee that the browsers in the real world actually conform to the standard perfectly.
    – MechMK1
    Feb 22 at 9:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.