Strict-Transport-Security header, the browser automatically converts all HTTP requests to HTTPS for the specified duration, even if the user types http://.Why It Matters for AI-Coded Apps
AI code generators almost never add security headers like HSTS. When vibe coding a web application, the LLM focuses on functionality and leaves the app accessible over both HTTP and HTTPS, allowing man-in-the-middle attackers to intercept traffic, steal session cookies, and inject malicious content during the initial HTTP request.
Real-World Example
A user accesses http://app.com on public WiFi. Without HSTS, the browser makes an unencrypted HTTP request that an attacker on the same network intercepts, stealing the session cookie. With HSTS (Strict-Transport-Security: max-age=31536000; includeSubDomains), the browser upgrades to HTTPS automatically before sending any data.
How to Detect and Prevent It
Add the HSTS header to all responses: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. Start with a short max-age (300 seconds) and increase after confirming HTTPS works everywhere. Submit your domain to the HSTS preload list for browser-level enforcement. Ensure all subdomains support HTTPS before using includeSubDomains.