Skip to main content

RFC 6797 - HTTP Strict Transport Security (HSTS)

Internet Engineering Task Force (IETF)
Request for Comments: 6797
Category: Standards Track
ISSN: 2070-1721

Authors:
J. Hodges (PayPal)
C. Jackson (Carnegie Mellon University)
A. Barth (Google, Inc.)

Publication Date: November 2012

Abstract​

This specification defines a mechanism enabling web sites to declare themselves accessible only via secure connections and/or for users to be able to direct their user agent(s) to interact with given sites only over secure connections. This overall policy is referred to as HTTP Strict Transport Security (HSTS). The policy is declared by web sites via the Strict-Transport-Security HTTP response header field and/or by other means, such as user agent configuration, for example.

Status of This Memo​

This is an Internet Standards Track document.

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741.

Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at:
````http://www.rfc-editor.org/info/rfc6797\````

Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (````http://trustee.ietf.org/license-info\````) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document.

Table of Contents​

Appendices​

Quick Reference​

Core Value of HSTS​

HSTS addresses the following critical web security issues by forcing HTTPS connections:

  1. SSL Stripping Attacks: Attackers replace HTTPS links with HTTP
  2. Man-in-the-Middle Attacks: Intercepting and modifying unencrypted traffic
  3. Session Hijacking: Stealing cookies transmitted over HTTP
  4. Mixed Content Issues: HTTPS pages loading HTTP resources

Basic Usage​

Server Configuration Example (Nginx):

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Browser Behavior:

User visits: http://example.com
Browser automatically converts to: https://example.com
Certificate error: Direct block, no bypass allowed

Deployment Recommendations​

  1. Testing Phase: max-age=300 (5 minutes)
  2. Initial Deployment: max-age=86400 (1 day)
  3. Stable Operation: max-age=31536000 (1 year)
  4. Preload List Entry: max-age=63072000; includeSubDomains; preload

Important Considerations​

⚠️ Important Warnings:

  • HSTS is difficult to quickly revoke once set
  • Ensure all subdomains support HTTPS before using includeSubDomains
  • Do not send HSTS headers in HTTP responses (they will be stripped)
  • Avoid using long-term max-age values in development environments

This RFC is one of the cornerstones of modern web security and is supported by all major browsers. Properly deploying HSTS can significantly enhance website security.

Last updated on