What is HSTS (HTTP Strict Transport Security) and how does it prevent SSL Stripping attacks?
❓ Interview Prompt: Explain HSTS, SSL Stripping attacks, `Strict-Transport-Security` header, `includeSubDomains`, `preload`, and browser HTTPS enforcement.
HSTS (HTTP Strict Transport Security) (RFC 6797) protects websites against SSL Stripping and Man-in-the-Middle (MitM) downgrade attacks:
SSL Stripping Scenario:
A user types 'example.com'. The browser makes an initial unencrypted 'http://example.com' request. A rogue Wi-Fi router intercepts it and strips HTTPS, keeping the victim on unencrypted HTTP!
HSTS Solution:
When the browser receives 'Strict-Transport-Security: max-age=31536000; includeSubDomains; preload', it records this rule. For 1 year, the browser will automatically convert ALL 'http://' URLs to 'https://' locally before issuing network requests!
Code Implementation Example
HTTP/1.1 200 OK
Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadHSTS forces browsers to convert HTTP URLs to HTTPS locally, neutralizing SSL stripping attacks.