3 ms·
Right, the website can opt-in to requiring TLS for connections. Browsers can choose to honor this and disallow all plain HTTP connections... and all TLS connect
by sp332 5y ago
Right, the website can opt-in to requiring TLS for connections. Browsers can choose to honor this and disallow all plain HTTP connections... and all TLS connections with "invalid" certificates. https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security It's a great way for site admins to turn a minor certificate issue into a complete disaster :(
- charrondev 5y agoIf you don’t use HSTS you open your users up to downgrade attacks. https://auth0.com/blog/preventing-https-downgrade-attacks/ https://auth0.com/blog/preventing-https-downgrade-attacks/