OWASPASVS 5.0 requirement
ASVS-V3.4.1 A strict-transport-security header field is included on all responses to enforce an http strict transport security (hsts) policy.
- Standard
- OWASP ASVS 5.0
- Chapter
- V3 Web Frontend Security
- Section
- V3.4 Browser Security Mechanism Headers
- Level
- L1 (requirement applies from this verification level up)
Requirement
Verify that a Strict-Transport-Security header field is included on all responses to enforce an HTTP Strict Transport Security (HSTS) policy. A maximum age of at least 1 year must be defined, and for L2 and up, the policy must apply to all subdomains as well.