Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Introducción a HSTS

Avatar for Boris Quiroz Boris Quiroz
April 26, 2014
Technology
57
0

Introducción a HSTS

Avatar for Boris Quiroz

Boris Quiroz

April 26, 2014

More Decks by Boris Quiroz

See All by Boris Quiroz
Secrets management with Vault
Avatar for Boris Quiroz boris
0
61
Docker Images Best Practices
Avatar for Boris Quiroz boris
0
58
Software Freedom Day 2015
Avatar for Boris Quiroz boris
0
47
Code Driven Infrastructure
Avatar for Boris Quiroz boris
0
74
hola mundo
Avatar for Boris Quiroz boris
0
67
DevOps Tools: Chef + Vagrant
Avatar for Boris Quiroz boris
0
230
Kitchen.CI
Avatar for Boris Quiroz boris
0
120
Hands-on Lab
Avatar for Boris Quiroz boris
0
83
Tech, Method & Philosophy for the cloud
Avatar for Boris Quiroz boris
0
59

Other Decks in Technology

See All in Technology
AWS DevOps Agentはチームメイトになれるのか？/ Can AWS DevOps Agent become a teammate
Avatar for Masanori Yamaguchi kinunori
6
680
弁護士ドットコム株式会社 エンジニア職向け 会社紹介資料
Avatar for 弁護士ドットコム bengo4com
1
130
Amazon S3 Filesについて
Avatar for Yuuki Yamashita yama3133
2
200
KGDC_13_Amazon Q Developerで挑む！ 13事例から見えたAX組織変革の最前線_公開情報
Avatar for michikazu.kikugawa kikugawa
0
110
ぼくがかんがえたさいきょうのあうとぷっと
Avatar for Yuuki Yamashita yama3133
0
180
JEDAI in Osaka 2026イントロ
Avatar for Takaaki Yayoi taka_aki
0
290
No Types Needed, Just Callable Method Check
Avatar for dak2 dak2
1
610
AIを共同作業者にして書籍を執筆する方法 / How to Write a Book with AI as a Co-Creator
Avatar for ama-ch ama_ch
2
130
Azure Static Web Apps の自動ビルドがタイムアウトしやすくなった状況に対応した件/global-azure2026
Avatar for TonyTonyKun thara0402
0
380
Sansan Engineering Unit 紹介資料
Avatar for Sansan, Inc. sansan33
PRO
1
4.3k
Rapid Start: Faster Internet Connections, with Ruby's Help
Avatar for kazuho kazuho
2
160
AI時代における技術的負債への取り組み
Avatar for Tadashi Shigeoka codenote
1
1.3k

Featured

See All Featured
Building AI with AI
Avatar for Ines Montani inesmontani
PRO
1
900
A Soul's Torment
Avatar for Nat Ma seathinner
6
2.7k
AI Search: Implications for SEO and How to Move Forward - #ShenzhenSEOConference
Avatar for Aleyda Solis aleyda
1
1.2k
Building an army of robots
Avatar for Kyle Neath kneath
306
46k
Why You Should Never Use an ORM
Avatar for John Nunemaker jnunemaker
PRO
61
9.8k
Making the Leap to Tech Lead
Avatar for Ryan Cromwell cromwellryan
135
9.8k
GraphQLとの向き合い方2022年版
Avatar for Yosuke Kurami quramy
50
15k
Conquering PDFs: document understanding beyond plain text
Avatar for Ines Montani inesmontani
PRO
4
2.6k
Public Speaking Without Barfing On Your Shoes - THAT 2023
Avatar for David Neal reverentgeek
1
370
Effective software design: The role of men in debugging patriarchy in IT @ Voxxed Days AMS
Avatar for Kenny Baas-Schwegler baasie
0
290
Abbi's Birthday
Avatar for Violet Bock coloredviolet
2
7k
Rails Girls Zürich Keynote
Avatar for Gregor Martynus gr2m
96
14k

Transcript

  1. HSTS WTF?

  2. None

  3. HTTP Strict Transport Security

  4. Asegurar que la comunicación no encriptada no es permitida en

    nuestro sitio para mitigar ataques como por ejemplo SSL-stripping.
  5. None

  6. ¡BIEN!

  7. None

  8. ¡MAL!

  9. 1. El usuario va a preyproject.com 2. El browser agregará

    el http:// y hará el request a http://preyproject.com 3. El server responderá con un 301 a https://preyproject.com 4. El browser hace el request a https://preyproject.com HSTS disabled

  10. HSTS enabled 1. El usuario va a preyproject.com 2. HSTS

    convertirá automáticamente el link de HTTP a HTTPS

  11. Compatibilidad Chrome, Firefox, Opera desde hace 3 versiones. Safari 7.0

    IE 12+

  12. El header Strict-Transport-Security: max-age:31536000; includeSubdomains

  13. None

  14. Nginx add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; Rails config.force_ssl = true La

    config

  15. PRELOAD LISTS

  16. ¿Preguntas? Boris Quiroz SRE Preyproject.com