O que é HSTS?
HSTS (HTTP Strict Transport Security) is a web security mechanism that forces browsers to interact with a website only over HTTPS. Once a browser receives an HSTS header, it automatically upgrades all future HTTP requests to HTTPS, even if the user types http:// in the address bar.
Como Funciona
The server sends a Strict-Transport-Security header with a max-age directive (e.g., max-age=31536000). The browser remembers this for the specified duration and refuses to make any unencrypted connections to the domain. The includeSubDomains directive extends protection to all subdomains.
Por Que Importa
HSTS prevents SSL stripping attacks where an attacker downgrades HTTPS to HTTP to intercept traffic. It also prevents users from bypassing certificate warnings, which could expose them to man-in-the-middle attacks.
Problemas Comuns
- HSTS not enabled, allowing SSL stripping
- max-age too short to be effective
- Missing includeSubDomains directive
- HSTS preload list submission requirements not met