Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

Introducción a HSTS

Avatar for Boris Quiroz Boris Quiroz
April 26, 2014
Technology
64
0

Introducción a HSTS

Avatar for Boris Quiroz

Boris Quiroz

April 26, 2014

More Decks by Boris Quiroz

See All by Boris Quiroz
Secrets management with Vault
Avatar for Boris Quiroz boris
0
73
Docker Images Best Practices
Avatar for Boris Quiroz boris
0
68
Software Freedom Day 2015
Avatar for Boris Quiroz boris
0
52
Code Driven Infrastructure
Avatar for Boris Quiroz boris
0
77
hola mundo
Avatar for Boris Quiroz boris
0
69
DevOps Tools: Chef + Vagrant
Avatar for Boris Quiroz boris
0
240
Kitchen.CI
Avatar for Boris Quiroz boris
0
120
Hands-on Lab
Avatar for Boris Quiroz boris
0
86
Tech, Method & Philosophy for the cloud
Avatar for Boris Quiroz boris
0
65

Other Decks in Technology

See All in Technology
HacobuにおけるFDEとは/登壇資料（戸井田 裕貴）
Avatar for Hacobu hacobu
PRO
1
560
全社共通データ基盤をつくる。ソニーのDatabricks活用とデータガバナンス設計の裏側
Avatar for ソニー株式会社 sony
0
230
【データ横丁主催】AI Agentがコンテキストを使って仕事をした後、何が残るのか― 組織の経験を次の判断に引き継ぐ「Agent Memory」
Avatar for KoheiOgawa shisyu_gaku
2
250
GitHub Agentic Workflows を触ってみる
Avatar for tkym htkym
2
870
Apache Iceberg が拓く AI 時代のオープンレイクハウス
Avatar for Tomohiro Tanaka tomtanaka
0
190
あなたの知らないAmazon VPC Route Server／Amazon VPC Route Server you don't know about
Avatar for モブエンジニア（Masaki Okuda） masakiokuda
0
150
ログラスのマルチプロダクトを 支える認証基盤 〜テナントごとに異なる統制とどう向き合うか〜
Avatar for Daiki Murayama dada4386
3
210
AIは推し活である。
Avatar for くらず / Kurazu kurazuuuuuu
2
1k
Claude Designがめちゃくちゃ便利なので使ってほしい
Avatar for morimorikochan diggymo
0
140
メルカリにおけるAI時代の高速プロトタイピング基盤「Arca」
Avatar for Ryota Arai ryotarai
18
13k
企業の現実世界をグラフで写し取る
Avatar for SansanTech sansantech
PRO
0
200
AWS DevOps Agent スキルをつかいこなそう / Master AWS DevOps Agent Skills
Avatar for Masanori Yamaguchi kinunori
2
630

Featured

See All Featured
How to optimise 3,500 product descriptions for ecommerce in one day using ChatGPT
Avatar for Katarina Dahlin katarinadahlin
PRO
3
3.8k
Speed Design
Avatar for Sergey Chernyshev sergeychernyshev
33
2.1k
Git: the NoSQL Database
Avatar for Brandon Keepers bkeepers
PRO
432
67k
Reality Check: Gamification 10 Years Later
Avatar for Sebastian Deterding codingconduct
0
2.3k
The untapped power of vector embeddings
Avatar for Frank van Dijk frankvandijk
2
1.9k
Java REST API Framework Comparison - PWX 2021
Avatar for Matt Raible mraible
34
9.7k
The Illustrated Guide to Node.js - THAT Conference 2024
Avatar for David Neal reverentgeek
1
540
Skip the Path - Find Your Career Trail
Avatar for Mark Kilby mkilby
1
240
AI in Enterprises - Java and Open Source to the Rescue
Avatar for ivargrimstad ivargrimstad
0
1.5k
Designing for Performance
Avatar for Lara Hogan lara
611
70k
Leveraging LLMs for student feedback in introductory data science courses - posit::conf(2025)
Avatar for Mine Cetinkaya-Rundel minecr
1
410
How to build an LLM SEO readiness audit: a practical framework
Avatar for Nick Samuel nmsamuel
2
930

Transcript

  1. HSTS WTF?

  2. None

  3. HTTP Strict Transport Security

  4. Asegurar que la comunicación no encriptada no es permitida en

    nuestro sitio para mitigar ataques como por ejemplo SSL-stripping.
  5. None

  6. ¡BIEN!

  7. None

  8. ¡MAL!

  9. 1. El usuario va a preyproject.com 2. El browser agregará

    el http:// y hará el request a http://preyproject.com 3. El server responderá con un 301 a https://preyproject.com 4. El browser hace el request a https://preyproject.com HSTS disabled

  10. HSTS enabled 1. El usuario va a preyproject.com 2. HSTS

    convertirá automáticamente el link de HTTP a HTTPS

  11. Compatibilidad Chrome, Firefox, Opera desde hace 3 versiones. Safari 7.0

    IE 12+

  12. El header Strict-Transport-Security: max-age:31536000; includeSubdomains

  13. None

  14. Nginx add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; Rails config.force_ssl = true La

    config

  15. PRELOAD LISTS

  16. ¿Preguntas? Boris Quiroz SRE Preyproject.com