Open Potherca opened 2 years ago
These are two separate solutions to the same problem. I would advise to use them both.
A HSTS header is only interpreted by the web browser client software, and can be ignored (though this would be against the standards).
The 301 HTTP-to-HTTPS redirect ensures that the web server software will never allow connections to the "http://" schema on tcp/80 and will send all web browser client softwares to HTTPS on tcp/443 instead. This cannot be ignored by the web client.
Currently, when the application is visited over HTTP, a 301 redirect response is given as per the spec:
But would it not be more desirable to use HTTP Strict Transport Security?
This has also come up on the Gitter chat:
See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security