HSTSohjeistus

HSTSohjeistus, also known as HTTP Strict Transport Security (HSTS), is a web security policy mechanism that helps to protect websites against protocol downgrade attacks and cookie hijacking. It is a security feature implemented by web servers to inform web browsers that they should only interact with the server over a secure HTTPS connection. Once a browser receives an HSTS header from a server, it will automatically convert all attempts to access that server over HTTP to HTTPS, even if the user types "http://" in the address bar.

The HSTS policy is enforced by the browser, which means that even if a user manually types "http://" in the address bar, the browser will automatically redirect the request to "https://". This helps to prevent man-in-the-middle attacks, where an attacker could intercept and modify the communication between the user and the server.

HSTS can be implemented with a simple HTTP header sent by the server. The header includes a "max-age" directive, which specifies the duration in seconds that the browser should remember the HSTS policy. The "includeSubDomains" directive can also be included to apply the policy to all subdomains of the site.

HSTS is supported by all modern web browsers, including Google Chrome, Mozilla Firefox, Microsoft Edge, and Apple Safari. It is considered a best practice for web security and is recommended for all websites that handle sensitive information. However, it is important to note that HSTS does not provide protection against the initial connection to the server, which can be vulnerable to man-in-the-middle attacks. To mitigate this, websites can use a preloaded HSTS list, which is a list of domains that are hardcoded into the browser and are always accessed over HTTPS.