I recently discovered during a penetration test that the HSTS was returned by the application but in this format:


Instead of:


Does this format mean that the header (HSTS) is not validated by the client and prevented from doing what it is designed to do? As I understand HTTP headers are case insensitive but I'm not sure if this is a valid header name.

Any advice is greatly appreciated. Thank you

1 Answer 1


This is an undefined header.

As such, how browsers react to it is browser-dependent. It is possible, but very unlikely, that they will still interpret the header correctly. However, I would not bet on it.

Instead, change the header from Strict-TransportSecurity to Strict-Transport-Security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.