4 ms·

Not being able to serve HTTPS is not a real concern. It seems possible but in reality it simply won’t happen. If it ever does break, you fix it, you don’t chang

Not being able to serve HTTPS is not a real concern. It seems possible but in reality it simply won’t happen. If it ever does break, you fix it, you don’t change protocols. Once you go HTTPS you’re all in regardless whether or not you’ve set HSTS headers. Let’s say your HTTPS certificate fails and you can’t get it replaced. So what, you’re going to temporarily move back to HTTP for a few days? Not going to happen! Everyone has already bookmarked/linked/shared/crawled your HTTPS URLs. There is no automated way to downgrade people to HTTP, so only the geeks who would even think to try removing the “s” will be able to visit. And most geeks won’t even do that because we’ve probably never encountered a situation where that has ever helped.

SquareWheel 7y ago
It happened to me. I served my site over TLS and used HSTS. Hosting got expensive, so I rebuilt my site on Github Pages and hosted there. It was another year and a half before they rolled out HTTPS for custom domains. In that case, old visitors were rejected due to the policy. I wish I had set a lower duration.
- sjwright 7y ago
  > old visitors were rejected due to the policy Also because their links and bookmarks would have all failed.
  - shawnz 7y ago
    But HSTS also blocks the workaround of "just Google it and find the page again"
    - LinuxBender 7y ago
      You can use the webmaster tools on Google to fix the indexing. It takes a few days, but worth the effort.
      - MichaelApproved 7y ago
        The issue is that the browser won't let you visit the insecure URL, regardless of how you get to it. It won't work because the HSTS setting the visitor got months ago told it not to.
        LinuxBender 7y ago
        That is exactly what I am talking about. In the webmaster tools, you want to get google to remove all references to the non https versions. Ensure https is up on all URL's, then use their tools to re-index everything and remove all references to http:// http:// Are you saying you can't set up https on some of your URL's?
        shawnz 7y ago
        The argument here is that enabling HSTS can be dangerous because if you enable it and then later become unable to serve HTTPS for some reason, you will have no way of turning it off. Even if you get your clients to manually edit their bookmarks to use HTTP again, their browsers will just rewrite the url to HTTPS anyway. There's no issue with switching FROM HTTP to HTTPS: that's easy, just redirect them. The issue is if you have to switch back.
        LinuxBender 7y ago
        I completely understand. The bookmark scenario is even easier than the google links. You simply set up https and the cached HSTS entries will work.
        shawnz 7y ago
        The scenario is assuming you have a working HSTS setup but then become unable to serve HTTPS for some reason (e.g. cert expires and you can't acquire a new one, or the provider just drops support for SSL for some reason, or you are forced to change providers to one that doesn't support SSL) HSTS can't be enabled on plain HTTP so it's not possible to create the problematic scenario if you never had SSL enabled to begin with. The problem is switching from SSL to non-SSL, not the other way around.

SquareWheel 7y ago

It happened to me. I served my site over TLS and used HSTS. Hosting got expensive, so I rebuilt my site on Github Pages and hosted there. It was another year and a half before they rolled out HTTPS for custom domains. In that case, old visitors were rejected due to the policy. I wish I had set a lower duration.

sjwright 7y ago
> old visitors were rejected due to the policy Also because their links and bookmarks would have all failed.
- shawnz 7y ago
  But HSTS also blocks the workaround of "just Google it and find the page again"
  - LinuxBender 7y ago
    You can use the webmaster tools on Google to fix the indexing. It takes a few days, but worth the effort.
    - MichaelApproved 7y ago
      The issue is that the browser won't let you visit the insecure URL, regardless of how you get to it. It won't work because the HSTS setting the visitor got months ago told it not to.
      - LinuxBender 7y ago
        That is exactly what I am talking about. In the webmaster tools, you want to get google to remove all references to the non https versions. Ensure https is up on all URL's, then use their tools to re-index everything and remove all references to http:// http:// Are you saying you can't set up https on some of your URL's?
        shawnz 7y ago
        The argument here is that enabling HSTS can be dangerous because if you enable it and then later become unable to serve HTTPS for some reason, you will have no way of turning it off. Even if you get your clients to manually edit their bookmarks to use HTTP again, their browsers will just rewrite the url to HTTPS anyway. There's no issue with switching FROM HTTP to HTTPS: that's easy, just redirect them. The issue is if you have to switch back.
        LinuxBender 7y ago
        I completely understand. The bookmark scenario is even easier than the google links. You simply set up https and the cached HSTS entries will work.
        shawnz 7y ago
        The scenario is assuming you have a working HSTS setup but then become unable to serve HTTPS for some reason (e.g. cert expires and you can't acquire a new one, or the provider just drops support for SSL for some reason, or you are forced to change providers to one that doesn't support SSL) HSTS can't be enabled on plain HTTP so it's not possible to create the problematic scenario if you never had SSL enabled to begin with. The problem is switching from SSL to non-SSL, not the other way around.