Read directives without accepting a malformed policy
02The header value is a semicolon-separated list of directives. A directive is an instruction such as max-age=300. Its syntax determines whether the browser can apply the policy at all.
Separate error-free secure response contains max-age=300 as its first HSTS field and max-age=0 as its second. The browser processes only the first. The server should have sent exactly one field.
Source for this drawing: RFC 6797 · Read RFC section 6.1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Ignore an invalid header as a whole; ignore only unknown directives inside an otherwise valid header.
- max-age is REQUIRED and its value, after quoted-string unescaping if needed, is one or more decimal digits specifying seconds. includeSubDomains is OPTIONAL and has no value. Directive order does not matter and names are case-insensitive.
- All directives MUST appear only once, including unrecognized ones. The browser MUST ignore a header containing invalid syntax or directive data. A duplicate max-age is not resolved by choosing a convenient value.
- The browser MUST ignore unrecognized directives and process recognized directives when the header otherwise satisfies the requirements. A quoted max-age such as "300" is valid; a negative or fractional value is not.
- If a secure response contains more than one HSTS header field, the browser MUST process only the first. This recovery rule does not permit servers to violate their one-field MUST.
- An HTML meta element with http-equiv="Strict-Transport-Security" MUST NOT be heeded. A page tag is not the response-header mechanism.
The bounded teaching parser accepts an ASCII subset of the referenced HTTP grammar, quoted escapes and semicolons inside quoted unknown values. Its size limits are local resource bounds, not RFC maximums. It does not implement all historical line folding.
Read the RFC section ↗