3 ms·
> Instead of using HSTS, you can also simply redirect any HTTP request to HTTPS I think this comment sums up my whole point about how less experienced develope
by LeonM 7y ago
> Instead of using HSTS, you can also simply redirect any HTTP request to HTTPS
I think this comment sums up my whole point about how less experienced developers must learn how to use headers.
Like others have commented, HSTS is used to fix potential dangers in forwarding (MITM attacks), it also reduces overhead.
> That way, you are certain that HTTPS is used, even if a browser does not understand HSTS.
If you use HSTS, you should always use a 301 permanent redirect as a fallback method for old browsers and other HTTP clients (like some libCurl implementations).
- amelius 7y agoI think what this comment thread really says is that the burden of fixing mistakes in the web's fundamental design is put on the individual developer and that this is another mistake! If MITM is a serious issue then it's an extremely bad idea to depend on individual developers of every website out there to mitigate this.
- majewsky 7y agoEverything else is just wishful thinking, though. Chrome cannot decide to just deprecate (e.g.) unsafe-inline CSS tags. It would break 90% of websites, and people would move to a different browser to get their websites to work.