https://takao.blog/ko/tags/hsts/Recent content in Hsts on Commentary of TakaoHugo -- gohugo.iokoCommentary of TakaoSun, 12 Jul 2026 04:12:51 +0900https://takao.blog/ko/web/web-security-http-strict-transport-hsts-hacks/Fri, 16 Jan 2026 00:00:00 +0900https://takao.blog/ko/web/web-security-http-strict-transport-hsts-hacks/<img src="https://takao.blog/img/thumbnail/web-security-http-strict-transport-hsts-hacks-ko.png" alt="Featured image of post Enforcing HTTPS Connections Securely using HSTS policies" /><h2 id="the-first-request-problem">The First-Request Problem </h2><p>HTTPS encrypts traffic after the 연결 is established, but the initial request to an HTTP URL is still sent in cleartext. An attacker on the same 네트워크 can intercept that first request, perform an <strong>SSL stripping</strong> attack, and downgrade the user to HTTP for the entire session.</p> <p>HTTP Strict Transport Security (HSTS) closes this window. Once a browser receives an HSTS header, it <strong>automatically upgrades all future HTTP requests</strong> to HTTPS and refuses to connect if the certificate is invalid.</p>