> but off the cuff I believe HSTS will prevent the browser from trusting a plaintext HTTP response at all Cookies are broken (i write about it on my blog like,

> but off the cuff I believe HSTS will prevent the browser from trusting a plaintext HTTP response at all Cookies are broken (i write about it on my blog like, daily). The essential idea of Forcing is injecting cookies into HTTPS space from HTTP.