The toy HSTS example keeps its boundary narrow.
What this toy model checks
The trust boundary parses one GET request, one response with Strict-Transport-Security, one max-age value, one remembered HTTPS row, and one empty body.
recompute HSTS rows \text{recompute HSTS rows} recompute HSTS rows HSTS honesty boundary The remembered HTTPS rule and empty response body are recomputed from the pinned HSTS response. HSTS honesty boundary - secure.example remembers HTTPS for 60 seconds section name value check request line method GET parsed request line path / parsed request line version HTTP/1.1 parsed header Host secure.example exact header Strict-Transport-Security max-age=60 exact directive name max-age parsed directive seconds 60 integer remembered rule host secure.example from request remembered rule rule HTTPS from HSTS remembered rule seconds 60 max-age status version HTTP/1.1 parsed status status 200 OK ok header Content-Length 0 empty body body byte length 0 counted check host secure.example exact check status 200 OK ok check max-age 60 seconds check remembered rule HTTPS for 60 seconds derived check sent body bytes 0 empty
Honesty boundary
NOTE: toy HTTP HSTS header only; not browser preload lists, subdomain policy, HTTPS redirects, certificate validation, TLS internals, mixed content, private browsing, clock behavior, cache clearing, HTTP/2 or HTTP/3, frameworks, or production security config.
toy HSTS header only \text{toy HSTS header only} toy HSTS header only HSTS honesty boundary The remembered HTTPS rule and empty response body are recomputed from the pinned HSTS response. HSTS honesty boundary - secure.example remembers HTTPS for 60 seconds section name value check request line method GET parsed request line path / parsed request line version HTTP/1.1 parsed header Host secure.example exact header Strict-Transport-Security max-age=60 exact directive name max-age parsed directive seconds 60 integer remembered rule host secure.example from request remembered rule rule HTTPS from HSTS remembered rule seconds 60 max-age status version HTTP/1.1 parsed status status 200 OK ok header Content-Length 0 empty body body byte length 0 counted check host secure.example exact check status 200 OK ok check max-age 60 seconds check remembered rule HTTPS for 60 seconds derived check sent body bytes 0 empty
No client compute
The page shows already validated rows. It does not simulate browser storage.
static validated rows \text{static validated rows} static validated rows HSTS honesty boundary The remembered HTTPS rule and empty response body are recomputed from the pinned HSTS response. HSTS honesty boundary - secure.example remembers HTTPS for 60 seconds section name value check request line method GET parsed request line path / parsed request line version HTTP/1.1 parsed header Host secure.example exact header Strict-Transport-Security max-age=60 exact directive name max-age parsed directive seconds 60 integer remembered rule host secure.example from request remembered rule rule HTTPS from HSTS remembered rule seconds 60 max-age status version HTTP/1.1 parsed status status 200 OK ok header Content-Length 0 empty body body byte length 0 counted check host secure.example exact check status 200 OK ok check max-age 60 seconds check remembered rule HTTPS for 60 seconds derived check sent body bytes 0 empty
Summary
HSTS can tell a client to remember HTTPS for a duration, but this page only models one tiny header.
HSTS boundary checked \text{HSTS boundary checked} HSTS boundary checked HSTS honesty boundary The remembered HTTPS rule and empty response body are recomputed from the pinned HSTS response. HSTS honesty boundary - secure.example remembers HTTPS for 60 seconds section name value check request line method GET parsed request line path / parsed request line version HTTP/1.1 parsed header Host secure.example exact header Strict-Transport-Security max-age=60 exact directive name max-age parsed directive seconds 60 integer remembered rule host secure.example from request remembered rule rule HTTPS from HSTS remembered rule seconds 60 max-age status version HTTP/1.1 parsed status status 200 OK ok header Content-Length 0 empty body body byte length 0 counted check host secure.example exact check status 200 OK ok check max-age 60 seconds check remembered rule HTTPS for 60 seconds derived check sent body bytes 0 empty