27 ms·
I dig the STS header, but isn't fixing the problem for only a small-ish percentage of browsers ... not really fixing the problem?
by jashkenas 16y ago
I dig the STS header, but isn't fixing the problem for only a small-ish percentage of browsers ... not really fixing the problem?
- pilif 16y agoNo. It's not. But without clients knowing about the fact that a site should be accessed only over SSL, there is no fix. Chrome isn't the only browser to support this. AFAIK, NoScript for Firefox also adds support and once this becomes widespread, more browsers might follow. Fixing the problem for some is certainly better than not fixing it and waiting for the perfect solution that might never appear. Especially if the fix is this easy to implement.
- briansmith 16y agoFirefox 4 betas have been shipping with STS support since June. See http://hg.mozilla.org/mozilla-central/rev/5dc3c2d2dd4f http://hg.mozilla.org/mozilla-central/rev/5dc3c2d2dd4f