htmlhttpfirefox

Why can't I put an HSTS header on a meta tag?

I'm using github pages and there's currently no way to force HTTPS with it, so I had the "bright" idea to put an HSTS header on a meta tag. So, I added this to the page:

<meta http-equiv="Strict-Transport-Security" content="max-age=31536000" />

And it didn't work. Why does it not work?! D:

My browser is Firefox Nightly.

Solution

  • According to RFC 6797 User Agents are not to heed the HSTS attribute settings on elements.