Chapter 70: Permissions Policy & Modern Security Headers

HTTP Strict Transport Security (HSTS) & Preload

**Part 14: Security & Best Practices** — Chapter 70: Feature Policy & Permissions Policy

LEARNING OBJECTIVES ⌵
  • Understand SSL-stripping Man-in-the-Middle (MitM) attacks.
  • Configure the Strict-Transport-Security (HSTS) HTTP response header.
  • Master the directives: max-age=63072000; includeSubDomains; preload.
  • Submit domains to the official Chromium HSTS Preload list (hstspreload.org).
🎬 INTERACTIVE VISUAL PIPELINE Core Architecture Simulation
🌐
1. Input
Directives & Tags
⚙️
2. Parse
Tokenizer & AST
🌳
3. Layout
Box Model & Flow
🎨
4. Render
GPU Paint & Composite
PHASE 1: INPUT & DIRECTIVES
Browser receives declarative markup stream, parsing tag tokens and initializing component state.

📖 The SSL Stripping Attack & HSTS Preloading

When a user types example.com into their browser address bar, the browser initially connects over insecure http://example.com:80. A public Wi-Fi hacker can intercept this initial request and downgrade the connection ("SSL Stripping"), preventing the upgrade to HTTPS.

HSTS Preload bakes your domain directly into the browser's source code (Chrome, Safari, Firefox, Edge). The browser refuses to ever make an HTTP request to your domain, instantly forcing HTTPS before a single network packet leaves the device!

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

📌 Key Takeaways

  • HSTS forces browsers to communicate strictly over HTTPS for the duration of max-age (typically 2 years = 63072000s).
  • Submitting to hstspreload.org eliminates the initial insecure HTTP connection roundtrip completely.
  • --

❓ Knowledge Check

1. Which of the following is correct?

2. Which of the following is correct?