Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Introducción a HSTS

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for Boris Quiroz Boris Quiroz
April 26, 2014
Technology
60
0

Introducción a HSTS

Avatar for Boris Quiroz

Boris Quiroz

April 26, 2014

More Decks by Boris Quiroz

See All by Boris Quiroz
Secrets management with Vault
Avatar for Boris Quiroz boris
0
69
Docker Images Best Practices
Avatar for Boris Quiroz boris
0
60
Software Freedom Day 2015
Avatar for Boris Quiroz boris
0
50
Code Driven Infrastructure
Avatar for Boris Quiroz boris
0
75
hola mundo
Avatar for Boris Quiroz boris
0
68
DevOps Tools: Chef + Vagrant
Avatar for Boris Quiroz boris
0
240
Kitchen.CI
Avatar for Boris Quiroz boris
0
120
Hands-on Lab
Avatar for Boris Quiroz boris
0
83
Tech, Method & Philosophy for the cloud
Avatar for Boris Quiroz boris
0
62

Other Decks in Technology

See All in Technology
失敗を資産に変えるClaude Code
Avatar for Shinya Saita shinyasaita
0
700
Snowflakeと仲良くなる第一歩
Avatar for あべ coco_se
4
500
AIっぽい文章を採点して人間らしく直すアプリを作ってみた
Avatar for Yuuki Yamashita yama3133
2
210
SONiCの統計情報を取得したい
Avatar for SONiC Users Group Japan sonic
0
190
Bucharest Tech Week 2026 - Reinventing testing practices in the AI era
Avatar for Eric Deandrea edeandrea
PRO
1
160
AIはどのように 組織のアジリティを変えるのか？
Avatar for J.K junki
4
990
機械学習を「社会実装」するということ 2026年夏版 / Social Implementation of Machine Learning June 2026 Version
Avatar for Moe Uchiike（内池 もえ） moepy_stats
6
2.5k
2026TECHFRESH畢業分享會 - Lightning Talk - E起 See See : 電商推薦讀心術? 數據說了算
Avatar for LINE Developers Taiwan line_developers_tw
PRO
0
1.2k
Agent Skills設計で柔軟性と硬さのバランスが難しい話
Avatar for nassy nassy20
0
140
なぜ Platform Engineering の土台に Kubernetes を選ぶのか
Avatar for Ray r4ynode
2
660
エンジニアリング戦略の作り方 / Crafting Engineering Strategy
Avatar for iwashi iwashi86
21
7k
SONiCで構築・運用する生成AI向けパブリッククラウドネットワーク ～実装編～
Avatar for SONiC Users Group Japan sonic
0
250

Featured

See All Featured
Design of three-dimensional binary manipulators for pick-and-place task avoiding obstacles (IECON2024)
Avatar for konakalab konakalab
0
460
Taking LLMs out of the black box: A practical guide to human-in-the-loop distillation
Avatar for Ines Montani inesmontani
PRO
3
2.3k
Applied NLP in the Age of Generative AI
Avatar for Ines Montani inesmontani
PRO
4
2.3k
Collaborative Software Design: How to facilitate domain modelling decisions
Avatar for Kenny Baas-Schwegler baasie
1
250
Everyday Curiosity
Avatar for Cassini Nazir cassininazir
0
230
Learning to Love Humans: Emotional Interface Design
Avatar for Aarron Walter aarron
275
41k
Building Flexible Design Systems
Avatar for Yesenia Perez-Cruz yeseniaperezcruz
330
40k
Claude Code どこまでも/ Claude Code Everywhere
Avatar for nwiizo nwiizo
65
56k
How GitHub (no longer) Works
Avatar for Zach Holman holman
316
150k
How Fast Is Fast Enough? [PerfNow 2025]
Avatar for Tammy Everts tammyeverts
3
610
First, design no harm
Avatar for Per Axbom axbom
PRO
2
1.2k
The SEO identity crisis: Don't let AI make you average
Avatar for Varn varn
0
490

Transcript

  1. HSTS WTF?

  2. None

  3. HTTP Strict Transport Security

  4. Asegurar que la comunicación no encriptada no es permitida en

    nuestro sitio para mitigar ataques como por ejemplo SSL-stripping.
  5. None

  6. ¡BIEN!

  7. None

  8. ¡MAL!

  9. 1. El usuario va a preyproject.com 2. El browser agregará

    el http:// y hará el request a http://preyproject.com 3. El server responderá con un 301 a https://preyproject.com 4. El browser hace el request a https://preyproject.com HSTS disabled

  10. HSTS enabled 1. El usuario va a preyproject.com 2. HSTS

    convertirá automáticamente el link de HTTP a HTTPS

  11. Compatibilidad Chrome, Firefox, Opera desde hace 3 versiones. Safari 7.0

    IE 12+

  12. El header Strict-Transport-Security: max-age:31536000; includeSubdomains

  13. None

  14. Nginx add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; Rails config.force_ssl = true La

    config

  15. PRELOAD LISTS

  16. ¿Preguntas? Boris Quiroz SRE Preyproject.com