Upgrade to PRO for Only $50/Year—Limited-Time Offer! 🔥

Introducción a HSTS

Avatar for Boris Quiroz Boris Quiroz
April 26, 2014
Technology
0
54

Introducción a HSTS

Avatar for Boris Quiroz

Boris Quiroz

April 26, 2014
Tweet

More Decks by Boris Quiroz

See All by Boris Quiroz
Secrets management with Vault
Avatar for Boris Quiroz boris
0
58
Docker Images Best Practices
Avatar for Boris Quiroz boris
0
56
Software Freedom Day 2015
Avatar for Boris Quiroz boris
0
45
Code Driven Infrastructure
Avatar for Boris Quiroz boris
0
69
hola mundo
Avatar for Boris Quiroz boris
0
64
DevOps Tools: Chef + Vagrant
Avatar for Boris Quiroz boris
0
230
Kitchen.CI
Avatar for Boris Quiroz boris
0
120
Hands-on Lab
Avatar for Boris Quiroz boris
0
79
Tech, Method & Philosophy for the cloud
Avatar for Boris Quiroz boris
0
54

Other Decks in Technology

See All in Technology
「Managed Instances」と「durable functions」で広がるAWS Lambdaのユースケース
Avatar for Lamaglama39 lamaglama39
0
300
ChatGPTで論⽂は読めるのか
Avatar for Spatial AI Network spatial_ai_network
5
20k
Playwright x GitHub Actionsで実現する「レビューしやすい」E2Eテストレポート
Avatar for kinosuke01 kinosuke01
0
570
Edge AI Performance on Zephyr Pico vs. Pico 2
Avatar for misoji engineer iotengineer22
0
140
re:Invent2025 コンテナ系アップデート振り返り(+CloudWatchログのアップデート紹介)
Avatar for 枡川健太郎 masukawa
0
350
AWSを使う上で最低限知っておきたいセキュリティ研修を社内で実施した話 ~みんなでやるセキュリティ~
Avatar for maimyyym maimyyym
2
300
大企業でもできる！ボトムアップで拡大させるプラットフォームの作り方
Avatar for ファインディ株式会社（イベント資料アップ用） findy_eventslides
1
710
RAG/Agent開発のアップデートまとめ
Avatar for sakai taka0709
0
160
生成AI時代におけるグローバル戦略思考
Avatar for Takaaki Yayoi taka_aki
0
120
Lambdaの常識はどう変わる？！re:Invent 2025 before after
Avatar for TomoyaIwata iwatatomoya
1
450
AWS Bedrock AgentCoreで作る 1on1支援AIエージェント 〜Memory × Evaluationsによる実践開発〜
Avatar for Yusuke Shimizu yusukeshimizu
6
390
A Compass of Thought: Guiding the Future of Test Automation ( #jassttokai25 , #jassttokai )
Avatar for teyamagu teyamagu
PRO
1
260

Featured

See All Featured
How STYLIGHT went responsive
Avatar for nonsquared nonsquared
100
6k
Building a Scalable Design System with Sketch
Avatar for Laura Van Doore lauravandoore
463
34k
Why Our Code Smells
Avatar for Brandon Keepers bkeepers
PRO
340
57k
We Have a Design System, Now What?
Avatar for Morgane Peng morganepeng
54
7.9k
The Success of Rails: Ensuring Growth for the Next 100 Years
Avatar for Eileen M. Uchitelle eileencodes
47
7.9k
Building an army of robots
Avatar for Kyle Neath kneath
306
46k
Raft: Consensus for Rubyists
Avatar for Patrick Van Stee vanstee
141
7.2k
Automating Front-end Workflow
Avatar for Addy Osmani addyosmani
1371
200k
What’s in a name? Adding method to the madness
Avatar for Product Marketing Alliance productmarketing
PRO
24
3.8k
GraphQLの誤解/rethinking-graphql
Avatar for sonatard sonatard
73
11k
Stop Working from a Prison Cell
Avatar for Chris Michel hatefulcrawdad
273
21k
Building Flexible Design Systems
Avatar for Yesenia Perez-Cruz yeseniaperezcruz
330
39k

Transcript

  1. HSTS WTF?

  2. None

  3. HTTP Strict Transport Security

  4. Asegurar que la comunicación no encriptada no es permitida en

    nuestro sitio para mitigar ataques como por ejemplo SSL-stripping.
  5. None

  6. ¡BIEN!

  7. None

  8. ¡MAL!

  9. 1. El usuario va a preyproject.com 2. El browser agregará

    el http:// y hará el request a http://preyproject.com 3. El server responderá con un 301 a https://preyproject.com 4. El browser hace el request a https://preyproject.com HSTS disabled

  10. HSTS enabled 1. El usuario va a preyproject.com 2. HSTS

    convertirá automáticamente el link de HTTP a HTTPS

  11. Compatibilidad Chrome, Firefox, Opera desde hace 3 versiones. Safari 7.0

    IE 12+

  12. El header Strict-Transport-Security: max-age:31536000; includeSubdomains

  13. None

  14. Nginx add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; Rails config.force_ssl = true La

    config

  15. PRELOAD LISTS

  16. ¿Preguntas? Boris Quiroz SRE Preyproject.com