(Note that Facebook now does use HSTS. The question was asked at a time when they didn't.)
To force a browser to always go directly to HTTPS for a website (and not rely on 302 redirects from the HTTP version), HSTS (HTTP Strict Transport Security) can be used.
To tell the browser that a website should always be visited using HTTPS a,
'Strict-Transport-Security' header can be sent in the HTTP response. From that moment on, the website will exist in the browser's HSTS list, and when someone types the site name (e.g. example.com
) in the URL bar, they will be sent to https://example.com/
rather than http://example.com
.
Google, Gmail, Twitter and Paypal are examples of major websites that make use of this functionality. Facebook, however, does not seem to send a 'Strict-Transport-Security' header in its responses. Can anyone give me a good reason why they have chosen not to use HSTS?