Live briefing
Everything about HTTP Strict Transport Security
Website protection mechanism
HTTP Strict Transport Security (HSTS) is a policy mechanism that helps to protect websites against man-in-the-middle attacks such as protocol downgrade attacks and cookie hijacking. It allows web servers to declare that web browsers should automatically interact with it using only HTTPS connections, which provide Transport Layer Security (TLS/SSL), unlike the insecure HTTP used alone. HSTS is an IETF standards track protocol and is specified in RFC 6797. Wikipedia →
🧠Start here: a 6-step reading path
- Read the overview: HTTP Strict Transport SecurityA 5-minute orientation
- Pick up a classic book: The Human PlanetThe most-reprinted book on the subject
- Read the landmark paper: CoStricTor: Collaborative HTTP Strict Transport Security in Tor BrowserCited 1 times
- Go sideways: Downgrade attackA closely related topic
- Go sideways: HTTPSA closely related topic
đź“– Definitions
No dictionary entry for this exact phrase.
🗂️ The subject at a glance
🏆 Landmark papers (most cited)
đź“š Books worth reading
The Human Planet · 2009
Ranked by number of editions on Open Library, a rough measure of how lasting a book is.
đź”— Related topics
- Downgrade attack A downgrade attack, also called a bidding-down attack, or version rollback attack, is a form of cryptographic attack on a computer system or communications…
- HTTPS Hypertext Transfer Protocol Secure (HTTPS) is an extension of the Hypertext Transfer Protocol (HTTP). It uses encryption for secure communication over…
- Server Name Indication Server Name Indication (SNI) is an extension to Transport Layer Security (TLS) where a client indicates which hostname it is attempting to connect to at…
- Public key certificate In cryptography, a public-key certificate, also known as a digital certificate or identity certificate, is an electronic document used to prove the valid…
- Transport Layer Security Transport Layer Security (TLS) is a cryptographic protocol designed to provide secured communications over a computer network, such as the Internet. The…
- POODLE POODLE (which stands for "Padding Oracle On Downgraded Legacy Encryption") is a security vulnerability which takes advantage of the fallback behavior of…
- Version history for TLS/SSL support in web browsers Version history for TLS/SSL support in web browsers tracks the implementation of Transport Layer Security protocol versions in major web browsers. Notes…
- Certificate authority In cryptography, a certificate authority or certification authority (CA) is an entity that stores, signs, and issues digital certificates. A digital certificate…