HTTP STS policy & using it in express

Inroduction
HSTS is a web security policy that tells the browser to access a particular website over HTTPS and can be used to prevent protocol downgrade attack & cookie hijacking. It is somewhat well supported by majority of browsers. It is communicated by the server to the client(browser) via HTTP response header field "Strict-Transport-Security" and follows the following syntax

strict-transport-security:max-age=expireTime [;includeSubdomains][;preload]

The header tells the browser to visit the site using HTTPS for the time specified in "expireTime"

The expireTime is in seconds. So max-age=15552000 tells the browser to visit a site only on HTTPS for the next six months. The other two optional parameter are

1. includeSubdomains : so if the header is set on doiloud.in , supported browsers will use HTTPS on blog.doitloud.in as well or any other subdomain for that matter.
2. preload : Since HSTS header is TOFU(trust on  first use) the very first request might have been tampered with by the attacker, so major browsers maintain a "STS preload list" that is shipped with the browser so that webiste uses HTTPS for the initial request. 

strict-transport-security header in response from the server

What if your site is loaded over HTTP? 

IF  you website is loaded over HTTP the Strict-Transport-Security header is ignored by the browser this is because an attacker might have intercepted the response and injected/removed the header. It is only when site is accessed over HTTPS with no certificate errors, the browser honors the header.


Configuring HSTS header in express 

So you can configure security headers in express using the helmet middleware which in turn is a collection of 10 small middlewares functions that can be used to setup various security headers.. This simple gist tells you how to configure helmet in express. The HSTS policy states that max-age should be defined in seconds, helmet accepts the value in milliseconds and rounds it off to the nearest second.

Limitations

1. As mentioned before this only works if your website actually has HTTPS. A user accessing your website over HTTP won't be told to switch to HTTPS, it just tells HTTPS user to stick around.