Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Introducción a HSTS

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for Boris Quiroz Boris Quiroz
April 26, 2014
Technology
59
0

Introducción a HSTS

Avatar for Boris Quiroz

Boris Quiroz

April 26, 2014

More Decks by Boris Quiroz

See All by Boris Quiroz
Secrets management with Vault
Avatar for Boris Quiroz boris
0
65
Docker Images Best Practices
Avatar for Boris Quiroz boris
0
58
Software Freedom Day 2015
Avatar for Boris Quiroz boris
0
47
Code Driven Infrastructure
Avatar for Boris Quiroz boris
0
74
hola mundo
Avatar for Boris Quiroz boris
0
68
DevOps Tools: Chef + Vagrant
Avatar for Boris Quiroz boris
0
230
Kitchen.CI
Avatar for Boris Quiroz boris
0
120
Hands-on Lab
Avatar for Boris Quiroz boris
0
83
Tech, Method & Philosophy for the cloud
Avatar for Boris Quiroz boris
0
60

Other Decks in Technology

See All in Technology
SLI/SLO、「完全に理解した」から「チョットデキル」へ
Avatar for maru maruloop
1
150
ボトムアップの改善の火を灯し続けろ！〜支援現場で学んだ、消えないための3つの打ち手〜 / 20260509 Kazuki Mori
Avatar for SHIFT EVOLVE shift_evolve
PRO
2
600
The 7 pitfalls of AI
Avatar for Uwe Friedrichsen ufried
0
200
多角的な視点から見たAGI
Avatar for Terisuke terisuke
0
130
Oracle Cloud Infrastructure presents managed, serverless MCP Servers for Oracle AI Database
Avatar for thatjeffsmith thatjeffsmith
0
200
Every Conversation Counts
Avatar for Yasunobu Kawaguchi kawaguti
PRO
0
170
ハーネスエンジニアリング入門
Avatar for hatyibei hatyibei
0
110
エンタープライズの厳格な制約を開発者に意識させない：クラウドネイティブ開発基盤設計/cloudnative-kaigi-golden-path
Avatar for みずほリサーチ&テクノロジーズ株式会社 先端技術研究部 mhrtech
0
370
CyberAgent YJC Connect
Avatar for shimayuu shimaf4979
1
170
20260507-ACL-seminar
Avatar for Satoshi5884 satoshi5884
0
100
（きっとたぶん）人材育成や教育のような何かの話
Avatar for Takanori Sejima sejima
0
670
カオナビに Suspenseを導入するまで / The Road to Suspense at kaonavi
Avatar for 株式会社カオナビ kaonavi
1
440

Featured

See All Featured
Test your architecture with Archunit
Avatar for Yoan thirion
1
2.2k
B2B Lead Gen: Tactics, Traps & Triumph
Avatar for Sophie Logan marketingsoph
0
110
Stop Working from a Prison Cell
Avatar for Chris Michel hatefulcrawdad
274
21k
Redefining SEO in the New Era of Traffic Generation
Avatar for Szymon Słowik szymonslowik
1
290
Game over? The fight for quality and originality in the time of robots
Avatar for Wayne Barker wayneb77
1
170
How To Stay Up To Date on Web Technology
Avatar for Chris Coyier chriscoyier
790
250k
Visualization
Avatar for Eitan Lees eitanlees
150
17k
AI Search:
Where Are We & What Can We Do About It?
Avatar for Aleyda Solis aleyda
0
7.4k
We Are The Robots
Avatar for Honza Javorek honzajavorek
0
220
RailsConf 2023
Avatar for Aaron Patterson tenderlove
30
1.4k
Believing is Seeing
Avatar for Spiro Bolos oripsolob
1
120
Lessons Learnt from Crawling 1000+ Websites
Avatar for Charles Meaden charlesmeaden
PRO
1
1.2k

Transcript

  1. HSTS WTF?

  2. None

  3. HTTP Strict Transport Security

  4. Asegurar que la comunicación no encriptada no es permitida en

    nuestro sitio para mitigar ataques como por ejemplo SSL-stripping.
  5. None

  6. ¡BIEN!

  7. None

  8. ¡MAL!

  9. 1. El usuario va a preyproject.com 2. El browser agregará

    el http:// y hará el request a http://preyproject.com 3. El server responderá con un 301 a https://preyproject.com 4. El browser hace el request a https://preyproject.com HSTS disabled

  10. HSTS enabled 1. El usuario va a preyproject.com 2. HSTS

    convertirá automáticamente el link de HTTP a HTTPS

  11. Compatibilidad Chrome, Firefox, Opera desde hace 3 versiones. Safari 7.0

    IE 12+

  12. El header Strict-Transport-Security: max-age:31536000; includeSubdomains

  13. None

  14. Nginx add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; Rails config.force_ssl = true La

    config

  15. PRELOAD LISTS

  16. ¿Preguntas? Boris Quiroz SRE Preyproject.com