I recently discovered during a penetration test that the HSTS was returned by the application but in this format:


Instead of:


Does this format mean that the header (HSTS) is not validated by the client and prevented from doing what it is designed to do? As I understand HTTP headers are case insensitive but I'm not sure if this is a valid header name.

Any advice is greatly appreciated. Thank you

1 Answer 1


This is an undefined header.

As such, how browsers react to it is browser-dependent. It is possible, but very unlikely, that they will still interpret the header correctly. However, I would not bet on it.

Instead, change the header from Strict-TransportSecurity to Strict-Transport-Security.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .