Which vulnerability is indicated by checking for the Strict-Transport-Security header in HTTP responses?

Which vulnerability is indicated by checking for the Strict-Transport-Security header in HTTP responses?

• A. Man-in-the-Middle
• B. Cross-Site Scripting
• C. SQL Injection
• D. CSRF

Answer: (A)

Strict-Transport-Security is about enforcing secure transport to protect communications from interception and tampering. When a server includes this header, the browser is told to always use HTTPS for that domain, which helps prevent Man-in-the-Middle attacks that try to downgrade a connection to HTTP or intercept TLS-encrypted traffic. So checking for the header signals an effort to mitigate MITM risk, and its presence reduces that vulnerability. The other issues—Cross-Site Scripting, SQL Injection, and CSRF—aren’t addressed by enforcing HTTPS; they involve input handling, database queries, or request forgery, which are separate concerns from transport security.

Strict-Transport-Security is about enforcing secure transport to protect communications from interception and tampering. When a server includes this header, the browser is told to always use HTTPS for that domain, which helps prevent Man-in-the-Middle attacks that try to downgrade a connection to HTTP or intercept TLS-encrypted traffic. So checking for the header signals an effort to mitigate MITM risk, and its presence reduces that vulnerability. The other issues—Cross-Site Scripting, SQL Injection, and CSRF—aren’t addressed by enforcing HTTPS; they involve input handling, database queries, or request forgery, which are separate concerns from transport security.