2

Why must a HSTS header not be sent on HTTP?

What would it hurt; clients could take it as a hint to redirect to https.

Improve this question
1

1 Answer 1

Reset to default
3

HTTP requests can be manipulated by third parties (mitigating this is one of the main purposes of HTTPS). What happens if a third party modifies a HTTP response to add a HSTS header? Imagine that this happens to a site which does not support HTTPS. The client now attempts to access the site over HTTPS, which is not supported. Voilà: the third party has completely blocked access to the site (and for quite some time, if it was a long-term HSTS header).

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .