liveBook · Manning

Hsts header

As explained in Real-World Cryptography

HSTS is an HTTP security policy mechanism that instructs a browser to access a website only over HTTPS for a specified period.

A browser may begin with an insecure HTTP connection, even when a website supports HTTPS. An HSTS response header tells the browser to use HTTPS for subsequent connections, helping prevent attackers from stripping an HTTP-to-HTTPS redirect. section 9.3

The protection has an important boundary:

  • After receiving the policy, the browser uses HTTPS for later connections to that website. section 9.3
  • The first connection can still be intercepted unless the user starts with HTTPS, because the attacker may remove the redirect. section 9.3

Redirect interception

A user types a website address without HTTPS. The server redirects the request to HTTPS, but an attacker intercepting that first HTTP connection can remove the redirect. HSTS is intended to prevent this on later connections. section 9.3

How Real-World Cryptography covers it

How deep it goes
Explains subsequent HTTPS enforcement and the unprotected first connection, but does not detail header directives or browser storage.
Examples
Uses an HTTP-to-HTTPS redirect and an attacker removing that redirect during the first connection.
What you can do after
Understand how HSTS reduces redirect-stripping risk after a browser has received the policy.
How it connects
Connects HTTP, HTTPS, redirects, TLS, browsers, and man-in-the-middle attacks.
Cover of Real-World Cryptography
liveBookmanning.com
Read Real-World Cryptography on liveBook Get the book at manning.com

Also explained in

Compare how 5 books explain hsts header →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.