Proper HTTP Strict-Transport-Security (HSTS) Implementation

⇤ Web Application Header Assessment

Optional for HTTP 1.0 and HTTP 1.1
Required for HTTP 1.0 (HTTPS) and HTTP 1.1 (HTTPS)

HTTP Strict-Transport-Security (HSTS) enforces the use of HTTP over TLS/SSL. Properly using this header can help prevent man-in-the-middle attacks (MITM). This header is defined in RFC-6797.

Requirements

• The max-age parameter is required.
• The includeSubDomains and preload parameters are optional. If present, we check to see if they are legitimate and that there are no associated values (i.e., syntax parsing).
• An HSTS header on an HTTP response is ignored.

See finding messages.