In the near future, the
HTTP Strict Transport Security (HSTS) standard will be supported by Firefox and Google Chrome browsers.
This specification provides an absolutely guaranteed way for the client to communicate with the server through a secure protocol.
Currently, while this standard is not supported, when connecting to the server, the default HTTP connection is established, and only then the browser switches to HTTPS, if available. Such a mechanism leaves the possibility for man-in-the-middle attacks. In turn, the HSTS protocol is designed to close this vulnerability. With the support of HSTS site creators can put the following command on the server
Strict-Transport-Security: max-age = 15768000
The
max-age parameter sets the time in seconds, how much to force an HTTPS session.
')
And then all HTTP requests will be forcibly redirected to HTTPS.
Firefox developers have
announced that their support will be implemented in the next version.