Skip to main content

Questions tagged [hsts]

HTTP Strict Transport Security is a mechanism enabling web sites to declare themselves accessible only via secure connections and/or for users to be able to direct their user agent(s) to interact with given sites only over secure connections. It is defined by RFC 6797.

Filter by
Sorted by
Tagged with
7 votes
3 answers
13k views

True or False: HSTS is absolutely useless against MITM attacks

I do understand that it is a good security measure to implement HSTS, because it will reduce the number of incidents. Statement 1: If clients IO traffic goes through MITM from the start, can the ...
Slava's user avatar
  • 285
15 votes
2 answers
4k views

HSTS behaviour within incognito mode?

By definition, incognito mode shouldn't leave a trail of visited websites. However, HSTS (HTTP Strict Transport Security) requires the browser to keep a database of hosts that have requested HSTS, ...
HRJ's user avatar
  • 283
6 votes
1 answer
2k views

Can HSTS be defeated?

As I know HSTS is mainly implemented to mitigate famous sslstrip attack in which browser is forced to use ssl when connecting to particular site. And I think it also prevents user to proceed to site ...
user3155036's user avatar
2 votes
3 answers
5k views

HTTP Header disabling non-SSL (or TLS) content on this page

Is there an HTTP Response header that disallows any non-SSL content from being displayed on the current page? The idea is some times external content that needs to be on the website (cough, ad ...
K.Steff's user avatar
  • 187
2 votes
2 answers
489 views

How to prevent attacks before HSTS is established for the first time? [closed]

What is the best way to accomplish this and prevent attacks like SSL Strip?
Phoenix Logan's user avatar
13 votes
3 answers
6k views

Why did Facebook not use HSTS for a long time after it became available?

(Note that Facebook now does use HSTS. The question was asked at a time when they didn't.) To force a browser to always go directly to HTTPS for a website (and not rely on 302 redirects from the HTTP ...
Michael's user avatar
  • 5,493
5 votes
1 answer
1k views

HTTP security headers on non HTML (images, JavaScript, etc)

Let's say, the HTTP security headers below are applied to all HTML pages of a site: HTTP Strict Transport Security (HSTS) X-Frame-Options (XFO) X-XSS-Protection X-Content-Type-Options Is it OK to ...
htanata's user avatar
  • 151
2 votes
1 answer
1k views

Caching Behaviour on major browsers

Before I even ask the question - this is a hard question to frame, so I welcome edits to improve clarity. How do major browsers decide how to cache responses, especially if said responses are ...
Karthik Rangarajan's user avatar
16 votes
2 answers
1k views

Twitter's HTTP response vs Google's HTTP response

I was looking at the HTTP responses form https://twitter.com and https://encrypted.google.com. These two responses have interesting similarities and differences in their security definitions. Both ...
rook's user avatar
  • 47.2k
10 votes
2 answers
10k views

Is there a problem with issuing a HSTS header in PHP?

I want to trial a HSTS policy on my blog without enabling it site wide initially. As a HSTS policy is just a HTTP response header would there be any problem with sending the header in PHP like so: ...
Scott Helme's user avatar
  • 3,238
11 votes
1 answer
2k views

Is HSTS (Strict-Transport-Security header) for HTTP or HTTPS?

Is the Strict-Transport-Security header intended for HTTP or HTTPS? What I mean is, do I respond with this header on a HTTP connection which in turn tells the browser to use HTTPS only from that point ...
Sam's user avatar
  • 211
26 votes
4 answers
2k views

How can a web application protect users when the browser doesn't support HSTS?

HTTP Strict Transport Security (HSTS) is a very useful feature at preventing OWASP a9 violations and attacks like SSLStrip which try and prevent the client from making a secure connection. This ...
rook's user avatar
  • 47.2k
33 votes
2 answers
12k views

HSTS extra security over HTTPS

Is HSTS good to use even if my servers are configured to use HTTPS (when HTTP is used, the rewrite rules in Apache turns it into HTTPS)? Also should HSTS be used even on resources like CSS and images,...
Novice User's user avatar
  • 2,118

1 2 3
4