Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Introducción a HSTS

Avatar for Boris Quiroz Boris Quiroz
April 26, 2014
Technology
0
54

Introducción a HSTS

Avatar for Boris Quiroz

Boris Quiroz

April 26, 2014
Tweet

More Decks by Boris Quiroz

See All by Boris Quiroz
Secrets management with Vault
Avatar for Boris Quiroz boris
0
58
Docker Images Best Practices
Avatar for Boris Quiroz boris
0
56
Software Freedom Day 2015
Avatar for Boris Quiroz boris
0
45
Code Driven Infrastructure
Avatar for Boris Quiroz boris
0
68
hola mundo
Avatar for Boris Quiroz boris
0
64
DevOps Tools: Chef + Vagrant
Avatar for Boris Quiroz boris
0
230
Kitchen.CI
Avatar for Boris Quiroz boris
0
120
Hands-on Lab
Avatar for Boris Quiroz boris
0
79
Tech, Method & Philosophy for the cloud
Avatar for Boris Quiroz boris
0
54

Other Decks in Technology

See All in Technology
IaC を使いたくないけどポリシー管理をどうにかしたい
Avatar for kazzpapa3 kazzpapa3
1
150
米軍Platform One / Black Pearlに学ぶ 極限環境DevSecOps
Avatar for jyoshise jyoshise
2
530
技術広報のOKRで生み出す 開発組織への価値 〜 カンファレンス協賛を通して育む学びの文化 〜 / Creating Value for Development Organisations Through Technical Communications OKRs — Nurturing a Culture of Learning Through Conference Sponsorship —
Avatar for Pauli pauli
5
520
AIと自動化がもたらす業務効率化の実例： 反社チェック等の調査・業務プロセス自動化
Avatar for enpipi enpipi
0
780
.NET 10のEntity Framework Coreの新機能
Avatar for tkym htkym
0
100
ABEJA FIRST GUIDE for Software Engineers
Avatar for ABEJA abeja
0
3.2k
FFMとJVMの実装から学ぶJavaのインテグリティ
Avatar for Kenji Kazumura kazumura
0
160
TypeScript 6.0で非推奨化されるオプションたち
Avatar for uhyo uhyo
15
4.9k
【M3】攻めのセキュリティの実践！プロアクティブなセキュリティ対策の実践事例
Avatar for mizu axelmizu
0
180
ECS組み込みのBlue/Greenデプロイを動かしてELB側の動きを観察してみる
Avatar for 矢儀丈博 yuki_ink
3
410
スタートアップの事業成長を支えるアーキテクチャとエンジニアリング
Avatar for どら doragt
1
7.1k
膨大なデータをどうさばく？ Java × MQで作るPub/Subアーキテクチャ
Avatar for igu zenta
0
120

Featured

See All Featured
Learning to Love Humans: Emotional Interface Design
Avatar for Aarron Walter aarron
274
41k
Helping Users Find Their Own Way: Creating Modern Search Experiences
Avatar for Dan Newman danielanewman
31
3k
GraphQLとの向き合い方2022年版
Avatar for Yosuke Kurami quramy
49
14k
How GitHub (no longer) Works
Avatar for Zach Holman holman
315
140k
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
Avatar for Eileen M. Uchitelle eileencodes
140
34k
Art, The Web, and Tiny UX
Avatar for Lynn Fisher lynnandtonic
303
21k
The Illustrated Children's Guide to Kubernetes
Avatar for Chris Short chrisshort
51
51k
Balancing Empowerment & Direction
Avatar for Lara Hogan lara
5
760
KATA
Avatar for Megan Lloyd mclloyd
PRO
32
15k
Side Projects
Avatar for Sacha Greif sachag
455
43k
StorybookのUI Testing Handbookを読んだ
Avatar for Shingo Yamazaki zakiyama
31
6.4k
Fireside Chat
Avatar for paigeccino paigeccino
41
3.7k

Transcript

  1. HSTS WTF?

  2. None

  3. HTTP Strict Transport Security

  4. Asegurar que la comunicación no encriptada no es permitida en

    nuestro sitio para mitigar ataques como por ejemplo SSL-stripping.
  5. None

  6. ¡BIEN!

  7. None

  8. ¡MAL!

  9. 1. El usuario va a preyproject.com 2. El browser agregará

    el http:// y hará el request a http://preyproject.com 3. El server responderá con un 301 a https://preyproject.com 4. El browser hace el request a https://preyproject.com HSTS disabled

  10. HSTS enabled 1. El usuario va a preyproject.com 2. HSTS

    convertirá automáticamente el link de HTTP a HTTPS

  11. Compatibilidad Chrome, Firefox, Opera desde hace 3 versiones. Safari 7.0

    IE 12+

  12. El header Strict-Transport-Security: max-age:31536000; includeSubdomains

  13. None

  14. Nginx add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; Rails config.force_ssl = true La

    config

  15. PRELOAD LISTS

  16. ¿Preguntas? Boris Quiroz SRE Preyproject.com