Skip to main content

Questions tagged [hsts]

HTTP Strict Transport Security is a mechanism enabling web sites to declare themselves accessible only via secure connections and/or for users to be able to direct their user agent(s) to interact with given sites only over secure connections. It is defined by RFC 6797.

Filter by
Sorted by
Tagged with
7 votes
3 answers

True or False: HSTS is absolutely useless against MITM attacks

I do understand that it is a good security measure to implement HSTS, because it will reduce the number of incidents. Statement 1: If clients IO traffic goes through MITM from the start, can the ...
Slava's user avatar
  • 285
15 votes
2 answers

HSTS behaviour within incognito mode?

By definition, incognito mode shouldn't leave a trail of visited websites. However, HSTS (HTTP Strict Transport Security) requires the browser to keep a database of hosts that have requested HSTS, ...
HRJ's user avatar
  • 283
6 votes
1 answer

Can HSTS be defeated?

As I know HSTS is mainly implemented to mitigate famous sslstrip attack in which browser is forced to use ssl when connecting to particular site. And I think it also prevents user to proceed to site ...
user3155036's user avatar
2 votes
3 answers

HTTP Header disabling non-SSL (or TLS) content on this page

Is there an HTTP Response header that disallows any non-SSL content from being displayed on the current page? The idea is some times external content that needs to be on the website (cough, ad ...
K.Steff's user avatar
  • 187
2 votes
2 answers

How to prevent attacks before HSTS is established for the first time? [closed]

What is the best way to accomplish this and prevent attacks like SSL Strip?
Phoenix Logan's user avatar
13 votes
3 answers

Why did Facebook not use HSTS for a long time after it became available?

(Note that Facebook now does use HSTS. The question was asked at a time when they didn't.) To force a browser to always go directly to HTTPS for a website (and not rely on 302 redirects from the HTTP ...
Michael's user avatar
  • 5,493
5 votes
1 answer

HTTP security headers on non HTML (images, JavaScript, etc)

Let's say, the HTTP security headers below are applied to all HTML pages of a site: HTTP Strict Transport Security (HSTS) X-Frame-Options (XFO) X-XSS-Protection X-Content-Type-Options Is it OK to ...
htanata's user avatar
  • 151
2 votes
1 answer

Caching Behaviour on major browsers

Before I even ask the question - this is a hard question to frame, so I welcome edits to improve clarity. How do major browsers decide how to cache responses, especially if said responses are ...
Karthik Rangarajan's user avatar
16 votes
2 answers

Twitter's HTTP response vs Google's HTTP response

I was looking at the HTTP responses form and These two responses have interesting similarities and differences in their security definitions. Both ...
rook's user avatar
  • 47.2k
10 votes
2 answers

Is there a problem with issuing a HSTS header in PHP?

I want to trial a HSTS policy on my blog without enabling it site wide initially. As a HSTS policy is just a HTTP response header would there be any problem with sending the header in PHP like so: ...
Scott Helme's user avatar
  • 3,238
11 votes
1 answer

Is HSTS (Strict-Transport-Security header) for HTTP or HTTPS?

Is the Strict-Transport-Security header intended for HTTP or HTTPS? What I mean is, do I respond with this header on a HTTP connection which in turn tells the browser to use HTTPS only from that point ...
Sam's user avatar
  • 211
26 votes
4 answers

How can a web application protect users when the browser doesn't support HSTS?

HTTP Strict Transport Security (HSTS) is a very useful feature at preventing OWASP a9 violations and attacks like SSLStrip which try and prevent the client from making a secure connection. This ...
rook's user avatar
  • 47.2k
33 votes
2 answers

HSTS extra security over HTTPS

Is HSTS good to use even if my servers are configured to use HTTPS (when HTTP is used, the rewrite rules in Apache turns it into HTTPS)? Also should HSTS be used even on resources like CSS and images,...
Novice User's user avatar
  • 2,118

1 2 3