3 ms·
If you permanently redirect http to https, is the HSTS header still needed?
by waterside81 12y ago
If you permanently redirect http to https, is the HSTS header still needed?
- jamoes 12y agoThe HSTS header is valuable because it prevents all future requests from the client from ever going over HTTP. So, for example, after visiting Hacker News once, the next time you type "news.ycombinator.com" into the URL bar, your browser will simply go directly to "https://news.ycombinator.com" https://news.ycombinator.com", rather than making the initial request to "http://news.ycombinator.com" http://news.ycombinator.com" as it usually would. This ensures that all future communications between the client and server are over a secure channel.