RFC 6797 / START HERE
HTTP Strict Transport Security, before the details
HSTS stands for HTTP Strict Transport Security. HTTP is Hypertext Transfer Protocol; HTTPS carries it over Transport Layer Security (TLS). HSTS tells a supporting browser to remember that a named website must be contacted using secure transport.
A website supplies a Strict-Transport-Security response header over an error-free HTTPS connection. The browser stores a duration and optional subdomain coverage, upgrades later HTTP links before requesting them and stops on secure-connection errors.
The idea in one picture
Secure response
Remember policy
Upgrade before sending
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
Offering HTTPS alone leaves room for accidental HTTP links and insecure first exchanges. This RFC defines the browser’s remembered transport policy and the server header that supplies it. It complements HTTP and TLS rather than replacing either.
A familiar example
A fictional browser has learned a policy for example.com. A later http://example.com/notes link is changed to HTTPS inside the browser before a request leaves. A first visit without learned or preconfigured policy can still have a bootstrap gap, and HSTS does not make a phishing site trustworthy.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Learn a policy only through error-free secure transportHTTP Strict Transport Security (HSTS) is a remembered browser policy. A website sends a Strict-Transport-Security response header over HTTPS, which carries HTTP over Transport Layer Security (TLS). The browser, called a user agent, can then insist on secure connections to that host.→
- Read directives without accepting a malformed policyThe header value is a semicolon-separated list of directives. A directive is an instruction such as max-age=300. Its syntax determines whether the browser can apply the policy at all.→
- Refresh, retain and remove one host’s stored policyThe browser stores each issuing host’s own policy with an expiry time and a subdomain flag. max-age is a duration measured from reception, not a fixed date chosen when the site first deployed HSTS.→
- Apply subdomain coverage without confusing policy ownershipA Domain Name System (DNS) name is a sequence of dot-separated labels, such as shop, example and com. HSTS compares the complete host name or whole labels to its right. Optional includeSubDomains extends a parent’s policy downward, while each host still owns its separate record.→
- Map ports and understand the first-visit boundaryHSTS changes how the browser prepares an HTTP load. It does not make a server speak TLS, repair a certificate, protect every other protocol or guarantee a safe first visit to a previously unknown host.→
This introduction explains RFC 6797 (2012). Read the original RFC ↗