Description

Detects when HTTP Strict Transport Security (HSTS) is configured with an insufficient max-age value (less than 1 year/31536000 seconds). A low HSTS max-age reduces the security benefit of HSTS by requiring more frequent renewal of the strict transport policy, potentially exposing users to downgrade attacks during renewal periods.

Detection Strategy

• Examines the Strict-Transport-Security HTTP response header for the max-age directive

• Reports a vulnerability if max-age is present but set to less than 31536000 seconds (1 year)

• Only triggers on responses that include an HSTS header with an explicit max-age value