Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Introducción a HSTS

Sponsored · Ship Features Fearlessly Turn features on and off without deploys. Used by thousands of Ruby developers. →
Avatar for Boris Quiroz Boris Quiroz
April 26, 2014
Technology
0
55

Introducción a HSTS

Avatar for Boris Quiroz

Boris Quiroz

April 26, 2014
Tweet

More Decks by Boris Quiroz

See All by Boris Quiroz
Secrets management with Vault
Avatar for Boris Quiroz boris
0
60
Docker Images Best Practices
Avatar for Boris Quiroz boris
0
57
Software Freedom Day 2015
Avatar for Boris Quiroz boris
0
46
Code Driven Infrastructure
Avatar for Boris Quiroz boris
0
71
hola mundo
Avatar for Boris Quiroz boris
0
66
DevOps Tools: Chef + Vagrant
Avatar for Boris Quiroz boris
0
230
Kitchen.CI
Avatar for Boris Quiroz boris
0
120
Hands-on Lab
Avatar for Boris Quiroz boris
0
82
Tech, Method & Philosophy for the cloud
Avatar for Boris Quiroz boris
0
59

Other Decks in Technology

See All in Technology
顧客との商談議事録をみんなで読んで顧客解像度を上げよう
Avatar for shibayu36 shibayu36
0
190
CDK対応したAWS DevOps Agentを試そう_20260201
Avatar for モブエンジニア（Masaki Okuda） masakiokuda
1
210
Webhook best practices for rock solid and resilient deployments
Avatar for Guillaume Laforge glaforge
1
270
Azure Durable Functions で作った NL2SQL Agent の精度向上に取り組んだ話/jat08
Avatar for TonyTonyKun thara0402
0
150
All About Sansan – for New Global Engineers
Avatar for Sansan, Inc. sansan33
PRO
1
1.3k
Cosmos World Foundation Model Platform for Physical AI
Avatar for Takuya MINAGAWA takmin
0
440
学生・新卒・ジュニアから目指すSRE
Avatar for Hiroya Onoe hiroyaonoe
2
570
データの整合性を保ちたいだけなんだ
Avatar for ShoheiMitani shoheimitani
8
3k
Frontier Agents (Kiro autonomous agent / AWS Security Agent / AWS DevOps Agent) の紹介
Avatar for msysh msysh
3
150
（金融庁共催）第4回金融データ活用チャレンジ勉強会資料
Avatar for tak takumimukaiyama
0
140
ZOZOにおけるAI活用の現在 ~開発組織全体での取り組みと試行錯誤~
Avatar for ZOZO Developers zozotech
PRO
5
4.9k
変化するコーディングエージェントとの現実的な付き合い方 〜Cursor安定択説と、ツールに依存しない「資産」〜
Avatar for empitsu empitsu
4
1.3k

Featured

See All Featured
What’s in a name? Adding method to the madness
Avatar for The Alliance productmarketing
PRO
24
3.9k
Refactoring Trust on Your Teams (GOTO; Chicago 2020)
Avatar for Rebecca Miller-Webster rmw
35
3.3k
Bioeconomy Workshop: Dr. Julius Ecuru, Opportunities for a Bioeconomy in West Africa
Avatar for AKADEMIYA2063 akademiya2063
PRO
1
54
Side Projects
Avatar for Sacha Greif sachag
455
43k
Learning to Love Humans: Emotional Interface Design
Avatar for Aarron Walter aarron
275
41k
Automating Front-end Workflow
Avatar for Addy Osmani addyosmani
1371
200k
Unlocking the hidden potential of vector embeddings in international SEO
Avatar for Frank van Dijk frankvandijk
0
170
Amusing Abliteration
Avatar for ianozsvald ianozsvald
0
96
Accessibility Awareness
Avatar for Sarah Abderemane sabderemane
0
49
How to build an LLM SEO readiness audit: a practical framework
Avatar for Nick Samuel nmsamuel
1
640
Mobile First: as difficult as doing things right
Avatar for Swwweet swwweet
225
10k
How to Align SEO within the Product Triangle To Get 
Buy-In & Support - #RIMC
Avatar for Aleyda Solis aleyda
1
1.4k

Transcript

  1. HSTS WTF?

  2. None

  3. HTTP Strict Transport Security

  4. Asegurar que la comunicación no encriptada no es permitida en

    nuestro sitio para mitigar ataques como por ejemplo SSL-stripping.
  5. None

  6. ¡BIEN!

  7. None

  8. ¡MAL!

  9. 1. El usuario va a preyproject.com 2. El browser agregará

    el http:// y hará el request a http://preyproject.com 3. El server responderá con un 301 a https://preyproject.com 4. El browser hace el request a https://preyproject.com HSTS disabled

  10. HSTS enabled 1. El usuario va a preyproject.com 2. HSTS

    convertirá automáticamente el link de HTTP a HTTPS

  11. Compatibilidad Chrome, Firefox, Opera desde hace 3 versiones. Safari 7.0

    IE 12+

  12. El header Strict-Transport-Security: max-age:31536000; includeSubdomains

  13. None

  14. Nginx add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; Rails config.force_ssl = true La

    config

  15. PRELOAD LISTS

  16. ¿Preguntas? Boris Quiroz SRE Preyproject.com