What is HTTP Strict Transport Security (HSTS)?
HTTP Strict Transport Security or HSTS is a web server directive that informs a browser that the website should be accessed only using HTTPS and that HTTP should not be used.
Why do we need HTTP Strict Transport Security (HSTS)?
Let’s say a user is using public Wi-Fi. But unknowingly, he is connected to a rogue Access Point. Now, he types the HTTP URL of the website in his browser. And the web application redirects him to HTTPS. However, the attacker intercepts the HTTP connection and redirects the user to a fraudulent website, which may look similar to the actual website. At this point, if the user is unaware of the attack and provides any sensitive credentials to the fraudulent website, the sensitive data will directly reach the attacker. HTTP Strict Transport Security header informs a browser that the website should be accessed using HTTPS only.








































0 Comments