Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Introducción a HSTS

Sponsored · Your Podcast. Everywhere. Effortlessly. Share. Educate. Inspire. Entertain. You do you. We'll handle the rest. →
Avatar for Boris Quiroz Boris Quiroz
April 26, 2014
Technology
60
0

Introducción a HSTS

Avatar for Boris Quiroz

Boris Quiroz

April 26, 2014

More Decks by Boris Quiroz

See All by Boris Quiroz
Secrets management with Vault
Avatar for Boris Quiroz boris
0
71
Docker Images Best Practices
Avatar for Boris Quiroz boris
0
63
Software Freedom Day 2015
Avatar for Boris Quiroz boris
0
51
Code Driven Infrastructure
Avatar for Boris Quiroz boris
0
76
hola mundo
Avatar for Boris Quiroz boris
0
69
DevOps Tools: Chef + Vagrant
Avatar for Boris Quiroz boris
0
240
Kitchen.CI
Avatar for Boris Quiroz boris
0
120
Hands-on Lab
Avatar for Boris Quiroz boris
0
86
Tech, Method & Philosophy for the cloud
Avatar for Boris Quiroz boris
0
64

Other Decks in Technology

See All in Technology
20分でわかるセキュアAPI
Avatar for nwiizo nwiizo
2
320
小粒でもパワフルなJS Runtime Antjsについて
Avatar for Comamoca comamoca
0
110
属人化を叩き割れ！「制作加速」と「安定化」の矛盾を打破する：8年目プロダクトが辿り着いた「ミスが起こり得ない」アセット制作フローの全貌
Avatar for gree_tech gree_tech
PRO
0
120
Invisible to AI? Making TYPO3 Sites Quotable by AI Search Systems
Avatar for Wolfgang Wagner wolfgangwagner
0
240
Go 1.27 の標準パッケージに uuid が入った！のでいろいろ喋る / go_127_std_go_uuid
Avatar for convto convto
3
540
ガバメント AI 源内を地方自治体は活用できるのか 可能性と課題、期待について
Avatar for takeda_h takeda_h
2
460
Sets in Go
Avatar for Luciano Ramalho ramalho
1
1.1k
猫付きpingコマンドを自作
Avatar for uyuki uyuki234
0
270
AI-DLC実践録_フルサイクル開発への挑戦
Avatar for Miyuki miyuc
0
310
AI時代のアウトプット――変わったこと、変わらないこと / Devsumi 2026 Kansai #devsumi
Avatar for Junichi Ito jnchito
0
310
AI開発に用いられるHPC技術について
Avatar for GPU UNITE gpuunite_official
0
150
医療の現場を変革に挑戦した半年間の軌跡 - PythonとAIで現場を変える / From Code to Care
Avatar for soudai sone soudai
PRO
0
250

Featured

See All Featured
How to optimise 3,500 product descriptions for ecommerce in one day using ChatGPT
Avatar for Katarina Dahlin katarinadahlin
PRO
2
3.8k
Into the Great Unknown - MozCon
Avatar for Noah Learner thekraken
41
2.7k
Claude Code のすすめ
Avatar for schroneko schroneko
67
230k
Creating an realtime collaboration tool: Agile Flush - .NET Oxford
Avatar for Marc Duiker marcduiker
35
2.5k
Thoughts on Productivity
Avatar for Jon Yablonski jonyablonski
76
5.3k
Building Applications with DynamoDB
Avatar for Matt Wood mza
96
7.2k
Navigating Team Friction
Avatar for Lara Hogan lara
192
16k
A Soul's Torment
Avatar for Nat Ma seathinner
6
3.5k
Leo the Paperboy
Avatar for Maya Tellez mayatellez
8
2.2k
The B2B funnel & how to create a winning content strategy
Avatar for Katarina Dahlin katarinadahlin
PRO
1
470
The Web Performance Landscape in 2024 [PerfNow 2024]
Avatar for Tammy Everts tammyeverts
12
1.3k
ReactJS: Keep Simple. Everything can be a component!
Avatar for Pedro Nauck pedronauck
666
130k

Transcript

  1. HSTS WTF?

  2. None

  3. HTTP Strict Transport Security

  4. Asegurar que la comunicación no encriptada no es permitida en

    nuestro sitio para mitigar ataques como por ejemplo SSL-stripping.
  5. None

  6. ¡BIEN!

  7. None

  8. ¡MAL!

  9. 1. El usuario va a preyproject.com 2. El browser agregará

    el http:// y hará el request a http://preyproject.com 3. El server responderá con un 301 a https://preyproject.com 4. El browser hace el request a https://preyproject.com HSTS disabled

  10. HSTS enabled 1. El usuario va a preyproject.com 2. HSTS

    convertirá automáticamente el link de HTTP a HTTPS

  11. Compatibilidad Chrome, Firefox, Opera desde hace 3 versiones. Safari 7.0

    IE 12+

  12. El header Strict-Transport-Security: max-age:31536000; includeSubdomains

  13. None

  14. Nginx add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; Rails config.force_ssl = true La

    config

  15. PRELOAD LISTS

  16. ¿Preguntas? Boris Quiroz SRE Preyproject.com