Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Introducción a HSTS

Avatar for Boris Quiroz Boris Quiroz
April 26, 2014
Technology
0
53

Introducción a HSTS

Avatar for Boris Quiroz

Boris Quiroz

April 26, 2014
Tweet

More Decks by Boris Quiroz

See All by Boris Quiroz
Secrets management with Vault
Avatar for Boris Quiroz boris
0
58
Docker Images Best Practices
Avatar for Boris Quiroz boris
0
56
Software Freedom Day 2015
Avatar for Boris Quiroz boris
0
45
Code Driven Infrastructure
Avatar for Boris Quiroz boris
0
67
hola mundo
Avatar for Boris Quiroz boris
0
63
DevOps Tools: Chef + Vagrant
Avatar for Boris Quiroz boris
0
230
Kitchen.CI
Avatar for Boris Quiroz boris
0
120
Hands-on Lab
Avatar for Boris Quiroz boris
0
78
Tech, Method & Philosophy for the cloud
Avatar for Boris Quiroz boris
0
53

Other Decks in Technology

See All in Technology
Perlアプリケーションで トレースを実装するまでの 工夫と苦労話
Avatar for masayoshi masayoshi
1
330
データ基盤の管理者からGoogle Cloud全体の管理者になっていた話
Avatar for ZOZO Developers zozotech
PRO
0
120
Strands Agents & Bedrock AgentCoreを1分でおさらい
Avatar for みのるん minorun365
PRO
6
110
恐怖！テストコードなき夜
Avatar for つくぼし tsukuboshi
2
110
2025-07-31: GitHub Copilot Agent mode at Vibe Coding Cafe (15min)
Avatar for ちょまど chomado
2
300
Power Automate のパフォーマンス改善レシピ / Power Automate Performance Improvement Recipes
Avatar for Takashi Shinohara karamem0
0
280
AI エンジニアの立場からみた、AI コーディング時代の開発の品質向上の取り組みと妄想
Avatar for Soh Ohara soh9834
8
630
LLMをツールからプラットフォームへ〜Ai Workforceの戦略〜 #BetAIDay
Avatar for LayerX layerx
PRO
1
590
AI時代の経営、Bet AI Vision #BetAIDay
Avatar for LayerX layerx
PRO
1
1k
Bet "Bet AI" - Accelerating Our AI Journey #BetAIDay
Avatar for LayerX layerx
PRO
4
1.1k
Google Cloud で学ぶデータエンジニアリング入門 2025年版 #GoogleCloudNext / 20250805
Avatar for 風音屋 (Kazaneya) kazaneya
PRO
4
740
AI駆動開発 with MixLeap Study【大阪支部 #3】
Avatar for LINEヤフーTech (LY Corporation Tech) lycorptech_jp
PRO
0
300

Featured

See All Featured
Making Projects Easy
Avatar for Brett Harned brettharned
117
6.3k
The Cult of Friendly URLs
Avatar for Andy Hume andyhume
79
6.5k
The Pragmatic Product Professional
Avatar for Laura Van Doore lauravandoore
36
6.8k
The MySQL Ecosystem @ GitHub 2015
Avatar for Sam Lambert samlambert
251
13k
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
Avatar for Kevin Liebholz kevinliebholz
34
5.9k
Practical Orchestrator
Avatar for Shlomi Noach shlominoach
190
11k
Improving Core Web Vitals using Speculation Rules API
Avatar for Sergey Chernyshev sergeychernyshev
18
1k
Typedesign – Prime Four
Avatar for Hannes Fritz hannesfritz
42
2.7k
Building Flexible Design Systems
Avatar for Yesenia Perez-Cruz yeseniaperezcruz
328
39k
Rails Girls Zürich Keynote
Avatar for Gregor Martynus gr2m
95
14k
Unsuck your backbone
Avatar for Amy Palamountain ammeep
671
58k
Dealing with People You Can't Stand - Big Design 2015
Avatar for Cassini Nazir cassininazir
367
26k

Transcript

  1. HSTS WTF?

  2. None

  3. HTTP Strict Transport Security

  4. Asegurar que la comunicación no encriptada no es permitida en

    nuestro sitio para mitigar ataques como por ejemplo SSL-stripping.
  5. None

  6. ¡BIEN!

  7. None

  8. ¡MAL!

  9. 1. El usuario va a preyproject.com 2. El browser agregará

    el http:// y hará el request a http://preyproject.com 3. El server responderá con un 301 a https://preyproject.com 4. El browser hace el request a https://preyproject.com HSTS disabled

  10. HSTS enabled 1. El usuario va a preyproject.com 2. HSTS

    convertirá automáticamente el link de HTTP a HTTPS

  11. Compatibilidad Chrome, Firefox, Opera desde hace 3 versiones. Safari 7.0

    IE 12+

  12. El header Strict-Transport-Security: max-age:31536000; includeSubdomains

  13. None

  14. Nginx add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; Rails config.force_ssl = true La

    config

  15. PRELOAD LISTS

  16. ¿Preguntas? Boris Quiroz SRE Preyproject.com