1

I recently discovered during a penetration test that the HSTS was returned by the application but in this format:

"Strict-TransportSecurity"

Instead of:

"Strict-Transport-Security"

Does this format mean that the header (HSTS) is not validated by the client and prevented from doing what it is designed to do? As I understand HTTP headers are case insensitive but I'm not sure if this is a valid header name.

Any advice is greatly appreciated. Thank you

Improve this question

1 Answer 1

Reset to default
2

This is an undefined header.

As such, how browsers react to it is browser-dependent. It is possible, but very unlikely, that they will still interpret the header correctly. However, I would not bet on it.

Instead, change the header from Strict-TransportSecurity to Strict-Transport-Security.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .