HTTP Strict Transport Security
HSTS tells a browser to remember HTTPS for future visits to a host. Duration and subdomain coverage require a deliberate operational decision.
Remember HTTPS for future calls
HTTP Strict Transport Security, or HSTS, is communicated through the response header Strict-Transport-Security. After receiving it over a secure HTTPS connection, the browser remembers to access this host only through HTTPS for the policy duration. Future HTTP addresses are rewritten accordingly. HSTS does not issue a certificate or repair TLS failures.
Check the scope before setting it
A fictional HTTPS response from portal.example contains Strict-Transport-Security: max-age=3600. This example value equals 1 hour and is not a general production target. The browser can store the rule for this host. Omitting the header later does not immediately cancel an already stored rule; its validity period continues.
Adding includeSubDomains would also cover descendant hosts. Before extending the scope, the team must check that every affected service is reliably available over HTTPS. A parent domain or a sibling host is not automatically covered.
If the browser has not learned the rule and no matching preload entry exists, the stored policy cannot protect the first HTTP request. Preloading is a separate process.
Sources
Related terms
- HttpOnly cookieHttpOnly prevents direct cookie access by page scripts. Matching requests can still carry the cookie; session and permission checks remain necessary.
- SameSite cookieSameSite affects cookie inclusion in cross-site requests. The choice must fit login and navigation flows; CSRF protection remains necessary.
- Content Security Policy (CSP)A CSP can restrict permitted script sources in the browser. A report-only policy observes violations but does not enforce those rules.
- Data minimisationData minimisation limits personal data to what is adequate, relevant and necessary for a defined purpose.
- Data retention policyA data retention policy defines the purpose, start, duration and end of storage. Deletion jobs and copies must be addressed in the implementation.
- Envelope encryptionEnvelope encryption separates the data key from the key protecting it. The encrypted file and wrapped data key need to be managed together.
Your project with ASES
Describe your project to us. We will get back to you with an initial assessment.