Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Introducción a HSTS

Avatar for Boris Quiroz Boris Quiroz
April 26, 2014
Technology
0
55

Introducción a HSTS

Avatar for Boris Quiroz

Boris Quiroz

April 26, 2014
Tweet

More Decks by Boris Quiroz

See All by Boris Quiroz
Secrets management with Vault
Avatar for Boris Quiroz boris
0
60
Docker Images Best Practices
Avatar for Boris Quiroz boris
0
57
Software Freedom Day 2015
Avatar for Boris Quiroz boris
0
46
Code Driven Infrastructure
Avatar for Boris Quiroz boris
0
70
hola mundo
Avatar for Boris Quiroz boris
0
66
DevOps Tools: Chef + Vagrant
Avatar for Boris Quiroz boris
0
230
Kitchen.CI
Avatar for Boris Quiroz boris
0
120
Hands-on Lab
Avatar for Boris Quiroz boris
0
80
Tech, Method & Philosophy for the cloud
Avatar for Boris Quiroz boris
0
55

Other Decks in Technology

See All in Technology
AI開発の落とし穴 〜馬には乗ってみよAIには添うてみよ〜
Avatar for SansanTech sansantech
PRO
9
4k
SREの仕事を自動化する際にやっておきたい5つのポイント
Avatar for Kazuto Kusama jacopen
6
1k
これまでのネットワーク運用を変えるかもしれないアプデをおさらい
Avatar for da-hatakeyama hatahata021
4
280
M5Stack Chain DualKey を UIFlow 2.0 ＋ USB接続で試す / ビジュアルプログラミングIoTLT vol.22
Avatar for you（@youtoy） you
PRO
2
120
アウトプットはいいぞ / output_iizo
Avatar for uhooi uhooi
0
140
書籍執筆での生成AIの活用
Avatar for Satoru Takeuchi sat
PRO
1
210
BiDiってなんだ？
Avatar for Tomoki Yamashita tomorrowkey
2
490
BPaaSオペレーション・kubell社内 n8n活用による効率化検証事例紹介
Avatar for KentaroFujii kentarofujii
0
300
AI開発をスケールさせるデータ中心の仕組みづくり
Avatar for Kazuyuki Miyazawa kzykmyzw
0
170
KubeCon + CloudNativeCon NA ‘25 Recap, Extensibility: Gateway API / NRI
Avatar for Aya (Igarashi) Ozawa ladicle
0
140
エンジニアとマネジメントの距離/Engineering and Management
Avatar for 小田中育生 ikuodanaka
3
630
AIとともに歩む情報セキュリティ / Information Security with AI
Avatar for Hokuto Hoshi kanny
4
2.2k

Featured

See All Featured
Dealing with People You Can't Stand - Big Design 2015
Avatar for Cassini Nazir cassininazir
367
27k
Deep Space Network (abreviated)
Avatar for Tony Rice tonyrice
0
36
Ruling the World: When Life Gets Gamed
Avatar for Sebastian Deterding codingconduct
0
130
Building a A Zero-Code AI SEO Workflow
Avatar for Ian Lurie portentint
PRO
0
270
Information Architects: The Missing Link in Design Systems
Avatar for Michelle Chin soysaucechin
0
750
Navigating Weather and Climate Data
Avatar for Ryan Abernathey rabernat
0
76
Taking LLMs out of the black box: A practical guide to human-in-the-loop distillation
Avatar for Ines Montani inesmontani
PRO
3
2k
JAMstack: Web Apps at Ludicrous Speed - All Things Open 2022
Avatar for David Neal reverentgeek
1
310
Site-Speed That Sticks
Avatar for Harry Roberts csswizardry
13
1k
Understanding Cognitive Biases in Performance Measurement
Avatar for Philip Tellis bluesmoon
32
2.8k
For a Future-Friendly Web
Avatar for Brad Frost brad_frost
181
10k
How to build a perfect <img>
Avatar for Jono Alderson jonoalderson
1
4.9k

Transcript

  1. HSTS WTF?

  2. None

  3. HTTP Strict Transport Security

  4. Asegurar que la comunicación no encriptada no es permitida en

    nuestro sitio para mitigar ataques como por ejemplo SSL-stripping.
  5. None

  6. ¡BIEN!

  7. None

  8. ¡MAL!

  9. 1. El usuario va a preyproject.com 2. El browser agregará

    el http:// y hará el request a http://preyproject.com 3. El server responderá con un 301 a https://preyproject.com 4. El browser hace el request a https://preyproject.com HSTS disabled

  10. HSTS enabled 1. El usuario va a preyproject.com 2. HSTS

    convertirá automáticamente el link de HTTP a HTTPS

  11. Compatibilidad Chrome, Firefox, Opera desde hace 3 versiones. Safari 7.0

    IE 12+

  12. El header Strict-Transport-Security: max-age:31536000; includeSubdomains

  13. None

  14. Nginx add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; Rails config.force_ssl = true La

    config

  15. PRELOAD LISTS

  16. ¿Preguntas? Boris Quiroz SRE Preyproject.com