HTTP Strict Transport Security (HSTS)

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 46
Abstract: This specification defines a mechanism enabling web sites to declare themselves accessible only via secure connections and/or for users to be able to direct their user agent(s) to interact with given sites only over secure connections. This overall policy is referred to as HTTP Strict Transport Security (HSTS). The policy is declared by web sites via the Strict-Transport-Security HTTP response header field and/or by other means, such as user agent configuration, for example. [STANDARDS-TRACK]
Publication Date: 2012-11-01
Status Note: Proposed Standard
DOI: 10.17487/RFC6797
Link: https://doi.org/10.17487/RFC6797
Author(s): Jeff Hodges
Collin Jackson
Adam Barth
Keyword(s): HTTPS, TLS, SSL, ForceHTTPS, MITM, Certificate Error, Certificate Verification, Secure Transport, IDNA-Canonicalization

Latest version of IETF RFC 6797

Document Versions — IETF RFC 6797

▶ IETF RFC 6797 (2012-11-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

The Unicode Consortium, "The Unicode Standard", < http://www.unicode.org/versions/latest/ >. EXTERNAL
Davis, M. and M. Suignard, "Unicode IDNA Compatibility Processing", Unicode Technical Standard #46, < http://unicode.org/reports/tr46/ >. EXTERNAL
IETF RFC 2119 [Active*]
IETF RFC 2616 [Superseded*]
IETF RFC 2818 [Superseded*]
IETF RFC 3490 [Superseded*]
IETF RFC 3864 [Active*]
IETF RFC 3986 [Active, Amended*]
IETF RFC 5246 [Superseded*]
IETF RFC 5890 [Active*]
IETF RFC 5891 [Active*]
IETF RFC 5895 [Active*]
IETF RFC 6698 [Active*]
W3C.html401.19991224 — [HTML-4.01] REC-html401-19991224, W3C Recommendation: HTML 4.01 Specification (December 24 th , 1999). EXTERNAL

Bibliographic Reference(s)

Jackson, C. and A. Barth, "Beware of Finer-Grained Origins", Web 2.0 Security and Privacy Workshop, Oakland, CA, USA, 2008, < http://seclab.stanford.edu/websec/origins/fgo.pdf >. EXTERNAL
Jackson, C. and A. Barth, "ForceHTTPS: Protecting High- Security Web Sites from Network Attacks", In Proceedings of the 17th International World Wide Web Conference (WWW2008) , 2008, < https://crypto.stanford.edu/forcehttps/ >. EXTERNAL
Good, N., Dhamija, R., Grossklags, J., Thaw, D., Aronowitz, S., Mulligan, D., and J. Konstan, "Stopping Spyware at the Gate: A User Study of Privacy, Notice and Spyware", In Proceedings of Symposium On Usable Privacy and Security (SOUPS) Pittsburgh, PA, USA, July 2005, < http://www.law.berkeley.edu/files/ Spyware_at_the_Gate.pdf >. EXTERNAL
Sunshine, J., Egelman, S., Almuhimedi, H., Atri, N., and L. Cranor, "Crying Wolf: An Empirical Study of SSL Warning Effectiveness", In Proceedings of 18th USENIX Security Symposium Montreal, Canada, August 2009, < http:// www.usenix.org/events/sec09/tech/full_papers/ sunshine.pdf >. EXTERNAL
"CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')", Common Weakness Enumeration < http://cwe.mitre.org/ >, The Mitre Corporation < http://www.mitre.org/ >, < http://cwe.mitre.org/data/definitions/113.html >. EXTERNAL
Coates, M., Wichers, D., Boberski, M., and T. Reguly, "Transport Layer Protection Cheat Sheet", Accessed: 11-Jul-2010, < http://www.owasp.org/index.php/ Transport_Layer_Protection_Cheat_Sheet >. EXTERNAL
Beck, M. and E. Tews, "Practical Attacks Against WEP and WPA", Second ACM Conference on Wireless Network Security Zurich, Switzerland, 2009, < http://dl.acm.org/citation.cfm?id=1514286 >. EXTERNAL
d'Otreppe, T., "Aircrack-ng", Accessed: 11-Jul-2010, < http://www.aircrack-ng.org/ >. EXTERNAL
Schmucker, N., "Web Tracking", SNET2 Seminar Paper - Summer Term, 2011, < http://www.snet.tu-berlin.de/ fileadmin/fg220/courses/SS11/snet-project/ web-tracking_schmuecker.pdf >. EXTERNAL
Various, "Firesheep", Wikipedia Online, ongoing, < https:// secure.wikimedia.org/wikipedia/en/w/ index.php?title=Firesheep&oldid=517474182 >. EXTERNAL
Fielding, R., Ed., and J. Reschke, Ed., "Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing", Work in Progress, October 2012. EXTERNAL
IETF RFC 1035 [Active, Amended*]
IETF RFC 2560 [Superseded*]
IETF RFC 4033 [Active*]
IETF RFC 4732 [Active*]
IETF RFC 4949 [Active*]
IETF RFC 5226 [Superseded*]
IETF RFC 5280 [Active, Amended*]
IETF RFC 5894 [Active*]
IETF RFC 5905 [Active*]
IETF RFC 6066 [Active*]
IETF RFC 6101 [Active*]
IETF RFC 6125 [Superseded*]
IETF RFC 6265 [Active*]
IETF RFC 6454 [Active*]
W3C.wsc-ui.20100812 — W3C.REC-wsc-ui-20100812 EXTERNAL

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC6797.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 6797, HTTP Strict Transport Security (HSTS). Available at https://doi.org/10.17487/RFC6797

Snippet:

IETF RFC 6797, HTTP Strict Transport Security (HSTS). Available at https://doi.org/10.17487/RFC6797

HTML (ISO 690 compliant)

Preview:

IETF RFC 6797, HTTP Strict Transport Security (HSTS). Available at https://doi.org/10.17487/RFC6797

Snippet:

<span class="citation"><cite>IETF RFC 6797</cite>, HTTP Strict Transport Security (HSTS). Available at <a href="https://doi.org/10.17487/RFC6797" target="_blank" rel="noopener">https://doi.org/10.17487/RFC6797</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 6797, HTTP Strict Transport Security (HSTS)
doi: 10.17487/RFC6797
url: https://doi.org/10.17487/RFC6797

Snippet:

<li>
<cite id="bib-rfc6797">IETF RFC 6797</cite>, HTTP Strict Transport Security (HSTS)
<span class="doi">10.17487/RFC6797</span>
</li>

Referenced By

IETF RFC 6920 [Active*]
IETF RFC 7457 [Active*]
IETF RFC 7525 [Superseded*]