Lock in $30 Savings on PRO—Offer Ends Soon! ⏳

Introducción a HSTS

Avatar for Boris Quiroz Boris Quiroz
April 26, 2014
Technology
0
55

Introducción a HSTS

Avatar for Boris Quiroz

Boris Quiroz

April 26, 2014
Tweet

More Decks by Boris Quiroz

See All by Boris Quiroz
Secrets management with Vault
Avatar for Boris Quiroz boris
0
58
Docker Images Best Practices
Avatar for Boris Quiroz boris
0
57
Software Freedom Day 2015
Avatar for Boris Quiroz boris
0
46
Code Driven Infrastructure
Avatar for Boris Quiroz boris
0
70
hola mundo
Avatar for Boris Quiroz boris
0
66
DevOps Tools: Chef + Vagrant
Avatar for Boris Quiroz boris
0
230
Kitchen.CI
Avatar for Boris Quiroz boris
0
120
Hands-on Lab
Avatar for Boris Quiroz boris
0
80
Tech, Method & Philosophy for the cloud
Avatar for Boris Quiroz boris
0
55

Other Decks in Technology

See All in Technology
AlmaLinux + KVM + Cockpit で始めるお手軽仮想化基盤 ～ 開発環境などでの利用を想定して ～
Avatar for koedoyoshida koedoyoshida
0
150
Bedrock AgentCore Evaluationsで学ぶLLM as a judge入門
Avatar for ShichijoYuhi shichijoyuhi
1
150
20251218_AIを活用した開発生産性向上の全社的な取り組みの進め方について / How to proceed with company-wide initiatives to improve development productivity using AI
Avatar for yayoi_dd yayoi_dd
0
620
Amazon Bedrock Knowledge Bases × メタデータ活用で実現する検証可能な RAG 設計
Avatar for Tomoaki tomoaki25
6
2.1k
普段使ってるClaude Skillsの紹介(by Notebooklm)
Avatar for Higuchi kokoro zerebom
8
2k
AWSの新機能をフル活用した「re:Inventエージェント」開発秘話
Avatar for みのるん minorun365
2
400
mairuでつくるクレデンシャルレス開発環境 / Credential-less development environment using Mailru
Avatar for Issei Naruta mirakui
5
590
子育てで想像してなかった「見えないダメージ」 / Unforeseen "hidden burdens" of raising children.
Avatar for Pauli pauli
2
320
フィッシュボウルのやり方 / How to do a fishbowl
Avatar for Pauli pauli
2
360
AWS re:Invent 2025~初参加の成果と学び~
Avatar for Kubo kubomasataka
0
180
New Relic 1 年生の振り返りと Cloud Cost Intelligence について #NRUG
Avatar for PLAY, inc. play_inc
0
210
AWS re:Invent 2025 re:Cap LT大会 データベース好きが語る re:Invent 2025 データベースアップデート/セッションの紹介
Avatar for Cold-Airflow coldairflow
0
160

Featured

See All Featured
[RailsConf 2023 Opening Keynote] The Magic of Rails
Avatar for Eileen M. Uchitelle eileencodes
31
9.8k
Sam Torres - BigQuery for SEOs
Avatar for Tech SEO Connect techseoconnect
PRO
0
140
A Modern Web Designer's Workflow
Avatar for Chris Coyier chriscoyier
698
190k
brightonSEO & MeasureFest 2025 - Christian Goodrich - Winning strategies for Black Friday CRO & PPC
Avatar for Christian Goodrich cargoodrich
2
61
The Straight Up "How To Draw Better" Workshop
Avatar for Dennis Kardys denniskardys
239
140k
How to Create Impact in a Changing Tech Landscape [PerfNow 2023]
Avatar for Tammy Everts tammyeverts
55
3.2k
Self-Hosted WebAssembly Runtime for Runtime-Neutral Checkpoint/Restore in Edge–Cloud Continuum
Avatar for Yuki Nakata chikuwait chikuwait
0
180
Leo the Paperboy
Avatar for Maya Tellez mayatellez
0
1.2k
KATA
Avatar for Megan Lloyd mclloyd
PRO
33
15k
Information Architects: The Missing Link in Design Systems
Avatar for Michelle Chin soysaucechin
0
710
Fashionably flexible responsive web design (full day workshop)
Avatar for Andy Clarke malarkey
407
66k
How To Speak Unicorn (iThemes Webinar)
Avatar for Michelle Schulp Hunt marktimemedia
1
340

Transcript

  1. HSTS WTF?

  2. None

  3. HTTP Strict Transport Security

  4. Asegurar que la comunicación no encriptada no es permitida en

    nuestro sitio para mitigar ataques como por ejemplo SSL-stripping.
  5. None

  6. ¡BIEN!

  7. None

  8. ¡MAL!

  9. 1. El usuario va a preyproject.com 2. El browser agregará

    el http:// y hará el request a http://preyproject.com 3. El server responderá con un 301 a https://preyproject.com 4. El browser hace el request a https://preyproject.com HSTS disabled

  10. HSTS enabled 1. El usuario va a preyproject.com 2. HSTS

    convertirá automáticamente el link de HTTP a HTTPS

  11. Compatibilidad Chrome, Firefox, Opera desde hace 3 versiones. Safari 7.0

    IE 12+

  12. El header Strict-Transport-Security: max-age:31536000; includeSubdomains

  13. None

  14. Nginx add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; Rails config.force_ssl = true La

    config

  15. PRELOAD LISTS

  16. ¿Preguntas? Boris Quiroz SRE Preyproject.com