4 ms·
Which is why you should only enable HSTS if you plan on supporting it permanently.
by nathancahill 10y ago
Which is why you should only enable HSTS if you plan on supporting it permanently.
- peterwwillis 10y ago"But there's no reason to not use HTTPS! What could go wrong?" But, you know... we have to secure our blog posts from MitM...
- eterm 10y agoNo, you have to secure your blog posts because cookies against the top level domain can be in the request headers sent to the subdomain[1]. It's a bit bizarre you'd blame HTTPS, what is your alternative, don't use https? [1] I say "can" because it depends on how the top level cookie is set, whether the browser respects the secure flag, and individual browser versions.