HTTP Strict Transport Security (HSTS) header not implemented

The most used web security policy mechanism is HTTP Strict Transport Security (HSTS). This header protects web applications against protocol downgrade attacks and cookie hijacking. This header also restricts the application from using only HTTPS communication. The header won’t allow communications via the insecure HTTP protocol. There are many web applications with the HTTP Strict Transport Security (HSTS) header cannot be recognised. These web applications are being served from not only HTTP but also HTTPS. It also lacks proper implementation of HSTS policy. HTTP Strict Transport Security is a web security policy mechanism to interact with complying user agents such as a web browser using only secure HTTP connections. This header informs the browser that, the site should not be loaded over HTTP. This header automatically converts all the requests to the site from HTTP to HTTPS.

Example

The following is the example of strict transport security header.

        Strict-Transport-Security: max-age=31536000

    

Impact

The main impact under this vulnerability:-

• As the communication is done via HTTP, the site will be vulnerable to man in the middle attack(MITM).

Mitigation / Precaution

• Configure your webserver to redirect HTTP requests to HTTPS.

        Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

    

Written by

Manindar Mohan

Cyber Security Lead Engineer

Manieendar is a dedicated Security Engineer with a wealth of experience in the cybersecurity landscape. He plays a pivotal role at Beagle Security, where he employs his extensive knowledge to safeguard systems against cyber threats. Manieendar's passion for cybersecurity extends beyond his professional role; he actively contributes to the online security community through insightful articles and speaking engagements.