Feature Introduction

HTTP Strict Transport Security (HSTS) is a method used by websites to declare that they can only be accessed through secure connections (HTTPS). By declaring HSTS, websites can force clients (such as browsers) to use only HTTPS to connect to the server, refusing all HTTP connections and preventing users from accepting insecure SSL certificates, thus reducing the risk of the very first request being intercepted. For example:

When your domain name is configured with HTTPS enabled and HTTP-to-HTTPS forced redirection at CDN, if a user enters a URL with the HTTP protocol in the browser to get the content, CDN node will forcibly redirect the HTTP request to the HTTPS. In this case:

If HSTS is not enabled, and if the user accesses the CDN node via HTTP protocol for the first time, the HTTP request may be intercepted or tampered, posing a security risk.

If HSTS is enabled, the CDN node will respond to the client with a HSTS header (for example: Strict-Transport-Security: max-age=xxxx; includeSubDomains), informing the client that only HTTPS protocol can be used to access the CDN node. From then on, the browser will directly use the HTTPS protocol to access the CDN node, without the need for HTTP-to-HTTPS forced redirection.

Notes

Before configuring HSTS, please ensure that you have successfully configured the HTTPS certificate. For detailed operation methods, please refer to: Add new Certificate.

Before HSTS takes effect, you can refer to: Forced Redirection Function, to enable users to forcibly redirect to HTTPS protocol when accessing for the first time via HTTP protocol.

Configuration Instructions

This feature is not self-serviceable for now. If you need to enable it, please contact our customer support team via hotline (852)31000000 or email global.noc@chinatelecomglobal.com for manual activation.

The following info should be clarified:

Parameters	Descriptions
Expiration time	Specifying the max-age value in the Strict-Transport-Security response header, unit second(s), for example, 2592000s represents HTTPS request is mandatory within a month.
Whether include subdomains	Specifying the value of includeSubDomains in the Strict-Transport-Security response header, if includeSubDomains is yes, then HTTPS request is mandatory for the domain and subdomains.

Content Delivery Network

HSTS configs