IPFYI
RFC 6797 Proposed Standard

HTTP Strict Transport Security (HSTS)

J. Hodges, C. Jackson, A. Barth · 2012-11

Abstract

This specification defines a mechanism enabling web sites to declare themselves accessible only via secure connections and/or for users to be able to direct their user agent(s) to interact with given sites only over secure connections. This overall policy is referred to as HTTP Strict Transport Security (HSTS).

Why This RFC Matters

RFC 6797 introduced HSTS, a simple but highly effective mechanism for eliminating SSL-stripping attacks: once a browser sees a Strict-Transport-Security response header, it refuses plain HTTP connections to that host for the specified max-age period. The 'includeSubDomains' directive extends protection to all subdomains, and the preload list maintained by browser vendors bootstraps HSTS protection even for first visits. HSTS is now a baseline security requirement for all public-facing HTTPS sites and is checked during Lighthouse audits, security scanner reports, and CA/Browser Forum Baseline Requirements compliance.

관련 프로토콜

HTTPS HTTP SSL-TLS

관련 용어

hsts ssl-tls encryption certificate authentication

Security에서 더 보기

RFC 2404 The Use of HMAC-SHA-1-96 within ESP and AH RFC 3602 The AES-CBC Cipher Algorithm and Its Use with IPsec RFC 4253 The Secure Shell (SSH) Transport Layer Protocol RFC 4254 The Secure Shell (SSH) Connection Protocol RFC 4301 Security Architecture for the Internet Protocol RFC 5246 The Transport Layer Security (TLS) Protocol Version 1.2 RFC 5280 Internet X.509 Public Key Infrastructure Certificate and CRL Profile RFC 6125 Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)