Strict Transport Security

The HTTP Strict Transport Security often abbreviated as HSTS is a security enhancement that can be opted by the web application using a response header which tells the browser that the web application must only be accessed using HTTPS. This will prevent any communication happening through the HTTP and will automatically convert the requests to HTTPS.

When client receives the HSTS response header it converts all the insecure links to secure links. If the loop hole in the security of a connection then the error message is shown straight away and the access to the web application will be completely denied.

HSTS tackles the following threats:

• Man in the middle is tackled effectively
• HSTS does not allow to override invalid certificate message.
• HSTS can also prevent stealing of credentials stored in cookies by widely available tools such as Firesheep.