What is the benefit of using this over simply redirecting / forcing SSL use for form handlers and other sensitive URLs on the application end.
Doesn't this just add more complexity to a problem that is not that hard to solve?
Doesn't this just add more complexity to a problem that is not that hard to solve?
Imagine you're using my WiFi connection. Without HSTS, I could redirect you to a fake http://www.facebook.com to steal your login credentials if you do not notice the login page is not served over HTTPS (and let's be realistic: most non-technical people won't notice something that's supposed to be there, but is not).