Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Introducción a HSTS

Avatar for Boris Quiroz Boris Quiroz
April 26, 2014
Technology
60
0

Introducción a HSTS

Avatar for Boris Quiroz

Boris Quiroz

April 26, 2014

More Decks by Boris Quiroz

See All by Boris Quiroz
Secrets management with Vault
Avatar for Boris Quiroz boris
0
69
Docker Images Best Practices
Avatar for Boris Quiroz boris
0
60
Software Freedom Day 2015
Avatar for Boris Quiroz boris
0
50
Code Driven Infrastructure
Avatar for Boris Quiroz boris
0
75
hola mundo
Avatar for Boris Quiroz boris
0
68
DevOps Tools: Chef + Vagrant
Avatar for Boris Quiroz boris
0
240
Kitchen.CI
Avatar for Boris Quiroz boris
0
120
Hands-on Lab
Avatar for Boris Quiroz boris
0
83
Tech, Method & Philosophy for the cloud
Avatar for Boris Quiroz boris
0
62

Other Decks in Technology

See All in Technology
プロダクトだけじゃない、社内プロセスにおける自動化・省力化ノススメ
Avatar for KAKEHASHI kakehashi
PRO
1
3.3k
アカウントが増えてからでは遅い? ~ マルチアカウント統制の勘所 ~
Avatar for KenichiNakamura kenichinakamura
0
210
End-to-Endで考える信頼性 — LINEアプリにおける クライアント開発×SRE連携の実践
Avatar for maru maruloop
4
3.8k
ADDF - ループエンジニアリングするフレームワークを作ったら/I Didn't Set Out to Build Loop Engineering, But ADDF Did
Avatar for 果物リン fruitriin
0
100
AWS Summit の片隅で、体育座りしながらコミュニティがにぎわう理由を考えた
Avatar for Kazuki Adachi k_adachi_01
2
370
事業価値を⽣み出すSREへ SREが担うべき意思決定の5層
Avatar for kenta_hi kenta_hi
2
3.1k
完全自律ロボットを作りたくて、先に開発を自律させた話(ROS Japan UG #63 LT)
Avatar for ありさん ( ari-san ) rryz09
0
440
次世代ランサムウェア対策の考察 / 20260704 Mitsutoshi Matsuo
Avatar for SHIFT EVOLVE shift_evolve
PRO
5
1.7k
プライバシー保護の理論と実践
Avatar for LINEヤフーTech (LY Corporation Tech) lycorptech_jp
PRO
1
250
スタートアップにおけるアジャイルの実践について #shibuyagile
Avatar for bayashi murabayashi
3
2.2k
地域 SRE コミュニティ最前線 / SRE NEXT 2026 Discussion Night Track C
Avatar for Masahiro Yoshizawa muziyoshiz
0
200
NDIAS CTF 2026 問題解説会資料
Avatar for bata_24 bata_24
0
180

Featured

See All Featured
Optimizing for Happiness
Avatar for Tom Preston-Werner mojombo
378
71k
A Tale of Four Properties
Avatar for Chris Coyier chriscoyier
163
24k
How to Grow Your eCommerce with AI & Automation
Avatar for Katarina Dahlin katarinadahlin
PRO
1
220
Unsuck your backbone
Avatar for Amy Palamountain ammeep
672
58k
<Decoding/> the Language of Devs - We Love SEO 2024
Avatar for Nikki Halliwell nikkihalliwell
1
270
Leo the Paperboy
Avatar for Maya Tellez mayatellez
8
1.9k
Discover your Explorer Soul
Avatar for Emna emna__ayadi
2
1.2k
AI Search: Implications for SEO and How to Move Forward - #ShenzhenSEOConference
Avatar for Aleyda Solis aleyda
1
1.3k
Easily Structure & Communicate Ideas using Wireframe
Avatar for Afnizar Nur Ghifari afnizarnur
194
17k
End of SEO as We Know It (SMX Advanced Version)
Avatar for Michael King ipullrank
3
4.3k
How to train your dragon (web standard)
Avatar for Monica Dinculescu notwaldorf
97
6.7k
No one is an island. Learnings from fostering a developers community.
Avatar for Antonio thoeni
21
3.8k

Transcript

  1. HSTS WTF?

  2. None

  3. HTTP Strict Transport Security

  4. Asegurar que la comunicación no encriptada no es permitida en

    nuestro sitio para mitigar ataques como por ejemplo SSL-stripping.
  5. None

  6. ¡BIEN!

  7. None

  8. ¡MAL!

  9. 1. El usuario va a preyproject.com 2. El browser agregará

    el http:// y hará el request a http://preyproject.com 3. El server responderá con un 301 a https://preyproject.com 4. El browser hace el request a https://preyproject.com HSTS disabled

  10. HSTS enabled 1. El usuario va a preyproject.com 2. HSTS

    convertirá automáticamente el link de HTTP a HTTPS

  11. Compatibilidad Chrome, Firefox, Opera desde hace 3 versiones. Safari 7.0

    IE 12+

  12. El header Strict-Transport-Security: max-age:31536000; includeSubdomains

  13. None

  14. Nginx add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; Rails config.force_ssl = true La

    config

  15. PRELOAD LISTS

  16. ¿Preguntas? Boris Quiroz SRE Preyproject.com