PTKDMobile App Security
Knowledge base / PTKD-API-NO-HSTS
low M5 MASVS-NETWORK-1 dynamic analysis PTKD-API-NO-HSTS

First-party HTTPS API without HSTS

A first-party HTTPS endpoint responded without a Strict-Transport-Security header, so a first request (or one after cache expiry) can be downgraded to HTTP by a network attacker.

How it's exploited

The app's HTTPS backend answers without Strict-Transport-Security. On a hostile network an attacker intercepts the very first (or a post-expiry) request, which the client may still attempt over HTTP, and downgrades it to plaintext before any redirect to HTTPS takes effect.

Why it matters

A window for SSL-stripping on each fresh connection, exposing the initial request and any credential it carries.

How to fix it

  1. Send Strict-Transport-Security with a long max-age (for example 63072000) and includeSubDomains on every HTTPS response.
  2. Preload the domain in the HSTS preload list once you are confident all subdomains are HTTPS-only.

References