Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Introducción a HSTS

Avatar for Boris Quiroz Boris Quiroz
April 26, 2014
Technology
0
54

Introducción a HSTS

Avatar for Boris Quiroz

Boris Quiroz

April 26, 2014
Tweet

More Decks by Boris Quiroz

See All by Boris Quiroz
Secrets management with Vault
Avatar for Boris Quiroz boris
0
58
Docker Images Best Practices
Avatar for Boris Quiroz boris
0
56
Software Freedom Day 2015
Avatar for Boris Quiroz boris
0
45
Code Driven Infrastructure
Avatar for Boris Quiroz boris
0
68
hola mundo
Avatar for Boris Quiroz boris
0
64
DevOps Tools: Chef + Vagrant
Avatar for Boris Quiroz boris
0
230
Kitchen.CI
Avatar for Boris Quiroz boris
0
120
Hands-on Lab
Avatar for Boris Quiroz boris
0
79
Tech, Method & Philosophy for the cloud
Avatar for Boris Quiroz boris
0
54

Other Decks in Technology

See All in Technology
AI機能プロジェクト炎上の 3つのしくじりと学び
Avatar for nakawai nakawai
0
150
生成AI時代のPythonセキュリティとガバナンス
Avatar for abenben abenben
0
150
From Natural Language to K8s Operations: The MCP Architecture and Practice of kubectl-ai
Avatar for Bo-Yi Wu appleboy
0
350
ラスベガスの歩き方 2025年版（re:Invent 事前勉強会）
Avatar for JunjiKoide junjikoide
0
560
Zero Trust DNS でより安全なインターネット アクセス
Avatar for Murachi Akira murachiakira
0
110
JSConf JPのwebsiteをGatsbyからNext.jsに移行した話 - Next.jsの多言語静的サイトと課題
Avatar for Leko leko
2
190
OpenCensusと歩んだ7年間
Avatar for Atsushi Tanaka bgpat
0
200
CREが作る自己解決サイクルSlackワークフローに組み込んだAIによる社内ヘルプデスク改革 #cre_meetup
Avatar for 弁護士ドットコム bengo4com
0
370
可観測性は開発環境から、開発環境にもオブザーバビリティ導入のススメ
Avatar for LayerX layerx
PRO
4
1.8k
だいたい分かった気になる 『SREの知識地図』 / introduction-to-sre-knowledge-map-book
Avatar for katsuhisa_ katsuhisa91
PRO
3
1.5k
ストレージエンジニアの仕事と、近年の計算機について / 第58回 情報科学若手の会
Avatar for Preferred Networks pfn
PRO
4
890
AI時代の発信活動 ～技術者として認知してもらうための発信法～ / 20251028 Masaki Okuda
Avatar for SHIFT EVOLVE shift_evolve
PRO
1
120

Featured

See All Featured
RailsConf 2023
Avatar for Aaron Patterson tenderlove
30
1.3k
How GitHub (no longer) Works
Avatar for Zach Holman holman
315
140k
Principles of Awesome APIs and How to Build Them.
Avatar for Keavy McMinn keavy
127
17k
The Web Performance Landscape in 2024 [PerfNow 2024]
Avatar for Tammy Everts tammyeverts
10
890
Testing 201, or: Great Expectations
Avatar for Joseph Mastey jmmastey
45
7.7k
Writing Fast Ruby
Avatar for Erik Berlin sferik
630
62k
Git: the NoSQL Database
Avatar for Brandon Keepers bkeepers
PRO
431
66k
Unsuck your backbone
Avatar for Amy Palamountain ammeep
671
58k
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
Avatar for Eileen M. Uchitelle eileencodes
140
34k
Speed Design
Avatar for Sergey Chernyshev sergeychernyshev
32
1.2k
Embracing the Ebb and Flow
Avatar for Simon Collison colly
88
4.9k
Bootstrapping a Software Product
Avatar for Garrett Dimon garrettdimon
PRO
307
110k

Transcript

  1. HSTS WTF?

  2. None

  3. HTTP Strict Transport Security

  4. Asegurar que la comunicación no encriptada no es permitida en

    nuestro sitio para mitigar ataques como por ejemplo SSL-stripping.
  5. None

  6. ¡BIEN!

  7. None

  8. ¡MAL!

  9. 1. El usuario va a preyproject.com 2. El browser agregará

    el http:// y hará el request a http://preyproject.com 3. El server responderá con un 301 a https://preyproject.com 4. El browser hace el request a https://preyproject.com HSTS disabled

  10. HSTS enabled 1. El usuario va a preyproject.com 2. HSTS

    convertirá automáticamente el link de HTTP a HTTPS

  11. Compatibilidad Chrome, Firefox, Opera desde hace 3 versiones. Safari 7.0

    IE 12+

  12. El header Strict-Transport-Security: max-age:31536000; includeSubdomains

  13. None

  14. Nginx add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; Rails config.force_ssl = true La

    config

  15. PRELOAD LISTS

  16. ¿Preguntas? Boris Quiroz SRE Preyproject.com