3 ms·
Amazon.com has HSTS, you can't access it from HTTP. If your website uses sessions at all, you need to use HTTPS just to protect from session hijacking. On ever
by echeese 10y ago
Amazon.com has HSTS, you can't access it from HTTP.
If your website uses sessions at all, you need to use HTTPS just to protect from session hijacking. On every page. Better yet, mark that cookie as secure-only.
- rocky1138 10y agoHi Ryan. I'm fairly confident that amazon.com is in the preload list in Chrome and Firefox, but if a given domain isn't, then the very first request from a browser may be to http which then includes the HSTS header and _then_ any subsequent request can only be over HTTPS.