3 ms·
If you don't use HSTS, you have to be _really_ sure that _all_ your users fully understand the risks of using an unencrypted connection. In the example you gav
by brlewis 7y ago
If you don't use HSTS, you have to be _really_ sure that _all_ your users fully understand the risks of using an unencrypted connection.
In the example you gave, wouldn't you have lost all your work anyway without HSTS? I don't think browsers supply an easy way to retry POST to the corresponding http: URL whether HSTS is set up or not.
- half-kh-hacker 7y agoWithout HSTS, you can inspect the cert and click through the invalid certificate warning. With HSTS, that button goes away in browsers.