Read HSTS

HSTS Header

The response carries a Strict-Transport-Security header.

highlighted = computed this step

The response includes Strict-Transport-Security

The table reads the response header that carries the rule.

Strict-Transport-Security\text{Strict-Transport-Security}
HSTS headerThe request host, HSTS response header, remembered rule, empty body, and checks are recomputed from pinned bytes.HSTS header - secure.example remembers HTTPS for 60 secondssectionnamevaluecheckrequest linemethodGETparsedrequest linepath/parsedrequest lineversionHTTP/1.1parsedheaderHostsecure.exampleexactheaderStrict-Transport-Securitymax-age=60exactdirectivenamemax-ageparseddirectiveseconds60integerremembered rulehostsecure.examplefrom requestremembered ruleruleHTTPSfrom HSTSremembered ruleseconds60max-agestatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckhostsecure.exampleexactcheckstatus200 OKokcheckmax-age60secondscheckremembered ruleHTTPS for 60 secondsderivedchecksent body bytes0empty

The header value is max-age

The value row is checked from the pinned response bytes.

max-age value checked\text{max-age value checked}
HSTS headerThe request host, HSTS response header, remembered rule, empty body, and checks are recomputed from pinned bytes.HSTS header - secure.example remembers HTTPS for 60 secondssectionnamevaluecheckrequest linemethodGETparsedrequest linepath/parsedrequest lineversionHTTP/1.1parsedheaderHostsecure.exampleexactheaderStrict-Transport-Securitymax-age=60exactdirectivenamemax-ageparseddirectiveseconds60integerremembered rulehostsecure.examplefrom requestremembered ruleruleHTTPSfrom HSTSremembered ruleseconds60max-agestatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckhostsecure.exampleexactcheckstatus200 OKokcheckmax-age60secondscheckremembered ruleHTTPS for 60 secondsderivedchecksent body bytes0empty

The response status is OK

The status row stays separate from the HSTS header row.

status=OK\text{status}=\text{OK}
HSTS headerThe request host, HSTS response header, remembered rule, empty body, and checks are recomputed from pinned bytes.HSTS header - secure.example remembers HTTPS for 60 secondssectionnamevaluecheckrequest linemethodGETparsedrequest linepath/parsedrequest lineversionHTTP/1.1parsedheaderHostsecure.exampleexactheaderStrict-Transport-Securitymax-age=60exactdirectivenamemax-ageparseddirectiveseconds60integerremembered rulehostsecure.examplefrom requestremembered ruleruleHTTPSfrom HSTSremembered ruleseconds60max-agestatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckhostsecure.exampleexactcheckstatus200 OKokcheckmax-age60secondscheckremembered ruleHTTPS for 60 secondsderivedchecksent body bytes0empty

Summary

The HSTS header is an exact response header in this toy page.

HSTS header checked\text{HSTS header checked}
HSTS headerThe request host, HSTS response header, remembered rule, empty body, and checks are recomputed from pinned bytes.HSTS header - secure.example remembers HTTPS for 60 secondssectionnamevaluecheckrequest linemethodGETparsedrequest linepath/parsedrequest lineversionHTTP/1.1parsedheaderHostsecure.exampleexactheaderStrict-Transport-Securitymax-age=60exactdirectivenamemax-ageparseddirectiveseconds60integerremembered rulehostsecure.examplefrom requestremembered ruleruleHTTPSfrom HSTSremembered ruleseconds60max-agestatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckhostsecure.exampleexactcheckstatus200 OKokcheckmax-age60secondscheckremembered ruleHTTPS for 60 secondsderivedchecksent body bytes0empty