Hacker News Reader

I don't get this header. Wouldn't the man-in-the-middle that is using something like sslstrip also be able to strip out any header they choose to?

View on HN

Yes, this is the case, but only in the first request. As soon as an HTTP user agent gets such an HSTS header, it will only communicate via HTTPS until max-age expires.

Only if the browser supports HSTS. Many do not, especially mobile browsers.

Reply on news.ycombinator.com