How does HSTS behaves when a url is requested without a browser head

Question

As part of the security improvements we were researching on security header and added HTTP headers including HSTS or Strict-Transport-Security. This header simply forces the browser to use the https version of the domain even if you request http version. As said in the documentation works as below,

The first time your site is accessed using HTTPS and it returns the Strict-Transport-Security header, the browser records this information, so that future attempts to load the site using HTTP will automatically use HTTPS instead.

Some of our hosted services will called without a browser head. This could be a from another application written in Java. Let's say a client calls one of the services http. Now, in this case how is the HSTS headers will be treated? will it redirect to the https based services or will it continue using the http one?

Answer 1

It depends entirely on the client. I would imagine that only browsers implement HSTS since it is meant as a protection against people using the wrong URLs and non-browsers are typically used by more technical users who would understand the URL.

Let's say a client calls one of the services http. Now, in this case how is the HSTS headers will be treated? will it redirect to the https based services or will it continue using the http one?

You are misunderstanding how HSTS works fundamentally. For a start HSTS should not be sent for a HTTP request and only for a HTTPS request. This is a security protection to prevent someone DoSing a HTTP-only site by adding the HSTS header (as HTTP traffic is insecure and can be altered en route - unlike HTTPS traffic). So an initial HTTP request will not be redirected, and so will not pick up the HSTS header. It is important to use HSTS and redirects.