What does the Strict-Transport-Security (HSTS) header do?
Options
- It encrypts the cookies that the site sets
- Tells browsers to use only HTTPS for the domain (Correct option)
- It blocks the page from being shown in iframes
- It enables CORS for requests from other origins
Answer
Tells browsers to use HTTPS only for the domain for a period, preventing SSL-stripping downgrades
Why
Even if your site redirects HTTP to HTTPS, the very first request may go over plain HTTP, and an attacker on the network can intercept it and keep the user on HTTP (SSL stripping).
HSTS tells the browser: 'for the next N months, only ever connect to this domain over HTTPS'. The browser then upgrades every request itself.
Remember
HSTS = browser always uses HTTPS for this site.