Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Introducción a HSTS

Avatar for Boris Quiroz Boris Quiroz
April 26, 2014
Technology
60
0

Introducción a HSTS

Avatar for Boris Quiroz

Boris Quiroz

April 26, 2014

More Decks by Boris Quiroz

See All by Boris Quiroz
Secrets management with Vault
Avatar for Boris Quiroz boris
0
69
Docker Images Best Practices
Avatar for Boris Quiroz boris
0
60
Software Freedom Day 2015
Avatar for Boris Quiroz boris
0
50
Code Driven Infrastructure
Avatar for Boris Quiroz boris
0
75
hola mundo
Avatar for Boris Quiroz boris
0
68
DevOps Tools: Chef + Vagrant
Avatar for Boris Quiroz boris
0
240
Kitchen.CI
Avatar for Boris Quiroz boris
0
120
Hands-on Lab
Avatar for Boris Quiroz boris
0
83
Tech, Method & Philosophy for the cloud
Avatar for Boris Quiroz boris
0
62

Other Decks in Technology

See All in Technology
プロダクト開発から業務改善コンサルまで。事業全体へ「染み出す」ことで広がるエンジニアの可能性
Avatar for ham ham0215
0
140
ACE-Step-1.5で見る 音楽生成AIのしくみと“破綻だけ直す”Retake機能の開発【zennfes spring 2026 登壇資料】
Avatar for asap personabb
1
520
気づかぬうちにセキュリティ負債を生むAPIキー運用
Avatar for Michitaka Sugawara sgwrmctk
0
170
Oracle AI Database@Azure：サービス概要のご紹介
Avatar for oracle4engineer oracle4engineer
PRO
6
2k
新しいUbuntu/GNOMEが使いたいからXからWaylandへ移行頑張ってるの巻 2026-06-20
Avatar for Nobuto Murata nobutomurata
0
140
AIAU_UMEMOGU_ninomiya_slide
Avatar for ninomiya ninomiya_ii
0
180
AIネイティブな開発のサプライチェーンリスク対策 〜激動の開発現場でリスクに立ち向かう〜【ZennFes】
Avatar for サイバーセキュリティクラウド cscengineer
PRO
2
140
【2026年版】 ベクトル検索とEmbedding最前線
Avatar for Tomoko Uchida mocobeta
9
2.9k
SONiC Scale-Up Working Group から探る Scale-UpやUltraEthernet機能の実装方法
Avatar for ebiken ebiken
PRO
2
370
Android の公式 Skill / Android skills
Avatar for Yuki Anzai yanzm
0
150
日本 Fintech 未来予測レポート 2027〜2028年（オリジナル版）
Avatar for 8maki 8maki
0
2.3k
【Snowflake Summit 2026 Recap!!】Snowflake Summit Deep Dive: Security & Governance
Avatar for Civitaspo civitaspo
1
240

Featured

See All Featured
Distributed Sagas: A Protocol for Coordinating Microservices
Avatar for Caitie McCaffrey caitiem20
333
22k
How to audit for AI Accessibility on your Front & Back End
Avatar for davetheseo davetheseo
0
430
DBのスキルで生き残る技術 - AI時代におけるテーブル設計の勘所
Avatar for soudai sone soudai
PRO
65
55k
ラッコキーワード サービス紹介資料
Avatar for ラッコ株式会社 rakko
1
3.7M
エンジニアに許された特別な時間の終わり
Avatar for watany watany
107
250k
Being A Developer After 40
Avatar for Adrian Kosmaczewski akosma
91
590k
How to Align SEO within the Product Triangle To Get 
Buy-In & Support - #RIMC
Avatar for Aleyda Solis aleyda
2
1.5k
The B2B funnel & how to create a winning content strategy
Avatar for Katarina Dahlin katarinadahlin
PRO
1
390
How To Stay Up To Date on Web Technology
Avatar for Chris Coyier chriscoyier
790
250k
Fantastic passwords and where to find them - at NoRuKo
Avatar for Phil Nash philnash
52
3.7k
Optimizing for Happiness
Avatar for Tom Preston-Werner mojombo
378
71k
Making Projects Easy
Avatar for Brett Harned brettharned
120
6.7k

Transcript

  1. HSTS WTF?

  2. None

  3. HTTP Strict Transport Security

  4. Asegurar que la comunicación no encriptada no es permitida en

    nuestro sitio para mitigar ataques como por ejemplo SSL-stripping.
  5. None

  6. ¡BIEN!

  7. None

  8. ¡MAL!

  9. 1. El usuario va a preyproject.com 2. El browser agregará

    el http:// y hará el request a http://preyproject.com 3. El server responderá con un 301 a https://preyproject.com 4. El browser hace el request a https://preyproject.com HSTS disabled

  10. HSTS enabled 1. El usuario va a preyproject.com 2. HSTS

    convertirá automáticamente el link de HTTP a HTTPS

  11. Compatibilidad Chrome, Firefox, Opera desde hace 3 versiones. Safari 7.0

    IE 12+

  12. El header Strict-Transport-Security: max-age:31536000; includeSubdomains

  13. None

  14. Nginx add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; Rails config.force_ssl = true La

    config

  15. PRELOAD LISTS

  16. ¿Preguntas? Boris Quiroz SRE Preyproject.com