$30 off During Our Annual Pro Sale. View Details »

Introducción a HSTS

Avatar for Boris Quiroz Boris Quiroz
April 26, 2014
Technology
0
55

Introducción a HSTS

Avatar for Boris Quiroz

Boris Quiroz

April 26, 2014
Tweet

More Decks by Boris Quiroz

See All by Boris Quiroz
Secrets management with Vault
Avatar for Boris Quiroz boris
0
58
Docker Images Best Practices
Avatar for Boris Quiroz boris
0
56
Software Freedom Day 2015
Avatar for Boris Quiroz boris
0
46
Code Driven Infrastructure
Avatar for Boris Quiroz boris
0
70
hola mundo
Avatar for Boris Quiroz boris
0
66
DevOps Tools: Chef + Vagrant
Avatar for Boris Quiroz boris
0
230
Kitchen.CI
Avatar for Boris Quiroz boris
0
120
Hands-on Lab
Avatar for Boris Quiroz boris
0
79
Tech, Method & Philosophy for the cloud
Avatar for Boris Quiroz boris
0
54

Other Decks in Technology

See All in Technology
WordPress は終わったのか ～今のWordPress の制作手法ってなにがあんねん？～ / Is WordPress Over? How We Build with WordPress Today
Avatar for tbshiki tbshiki
2
840
re:Invent2025 コンテナ系アップデート振り返り(+CloudWatchログのアップデート紹介)
Avatar for 枡川健太郎 masukawa
0
390
マイクロサービスへの5年間 ぶっちゃけ何をしてどうなったか
Avatar for Tomohiro Hashidate joker1007
17
6.7k
生成AI時代におけるグローバル戦略思考
Avatar for Takaaki Yayoi taka_aki
0
210
多様なデジタルアイデンティティを攻撃からどうやって守るのか / 20251212
Avatar for Ayokura ayokura
0
490
Bedrock AgentCore Memoryの新機能 (Episode) を試してみた / try Bedrock AgentCore Memory Episodic functionarity
Avatar for hoshi7_n hoshi7_n
1
480
ChatGPTで論⽂は読めるのか
Avatar for Spatial AI Network spatial_ai_network
11
29k
AI時代のワークフロー設計〜Durable Functions / Step Functions / Strands Agents を添えて〜
Avatar for やくも yakumo
3
890
生成AIを利用するだけでなく、投資できる組織へ / Becoming an Organization That Invests in GenAI
Avatar for 株式会社カミナシ kaminashi
0
110
Strands AgentsとNova 2 SonicでS2Sを実践してみた
Avatar for Yuuki Yamashita yama3133
0
540
Oracle Cloud Infrastructure IaaS 新機能アップデート 2025/09 - 2025/11
Avatar for oracle4engineer oracle4engineer
PRO
0
170
Jakarta Agentic AI Specification - Status and Future
Avatar for Reza Rahman reza_rahman
0
110

Featured

See All Featured
Distributed Sagas: A Protocol for Coordinating Microservices
Avatar for Caitie McCaffrey caitiem20
333
22k
HU Berlin: Industrial-Strength Natural Language Processing with spaCy and Prodigy
Avatar for Ines Montani inesmontani
PRO
0
83
The innovator’s Mindset - 
Leading Through an Era of Exponential Change - McGill University 2025
Avatar for Jean-Marc De Jonghe jdejongh
PRO
1
62
Side Projects
Avatar for Sacha Greif sachag
455
43k
How to Create Impact in a Changing Tech Landscape [PerfNow 2023]
Avatar for Tammy Everts tammyeverts
55
3.1k
Measuring & Analyzing Core Web Vitals
Avatar for Philip Tellis bluesmoon
9
710
Designing for humans not robots
Avatar for Tammie Lister tammielis
254
26k
The Psychology of Web Performance [Beyond Tellerrand 2023]
Avatar for Tammy Everts tammyeverts
49
3.2k
Lightning talk: Run Django tests with GitHub Actions
Avatar for Sarah Abderemane sabderemane
0
86
Organizational Design Perspectives: An Ontology of Organizational Design Elements
Avatar for Dr. Kim W Petersen kimpetersen
PRO
0
38
Data-driven link building: lessons from a $708K investment (BrightonSEO talk)
Avatar for Szymon szymonslowik
0
840
Put a Button on it: Removing Barriers to Going Fast.
Avatar for kastner kastner
60
4.1k

Transcript

  1. HSTS WTF?

  2. None

  3. HTTP Strict Transport Security

  4. Asegurar que la comunicación no encriptada no es permitida en

    nuestro sitio para mitigar ataques como por ejemplo SSL-stripping.
  5. None

  6. ¡BIEN!

  7. None

  8. ¡MAL!

  9. 1. El usuario va a preyproject.com 2. El browser agregará

    el http:// y hará el request a http://preyproject.com 3. El server responderá con un 301 a https://preyproject.com 4. El browser hace el request a https://preyproject.com HSTS disabled

  10. HSTS enabled 1. El usuario va a preyproject.com 2. HSTS

    convertirá automáticamente el link de HTTP a HTTPS

  11. Compatibilidad Chrome, Firefox, Opera desde hace 3 versiones. Safari 7.0

    IE 12+

  12. El header Strict-Transport-Security: max-age:31536000; includeSubdomains

  13. None

  14. Nginx add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; Rails config.force_ssl = true La

    config

  15. PRELOAD LISTS

  16. ¿Preguntas? Boris Quiroz SRE Preyproject.com