4 ms·
I don't know if it's still the case, but it used to be that if you accidently set a localhost webserver to redirect to HTTPS while you were developing then brow
by VWWHFSfQ 4y ago
I don't know if it's still the case, but it used to be that if you accidently set a localhost webserver to redirect to HTTPS while you were developing then browsers would remember that and from then on require HTTPS for all of eternity until you could figure out how to make it stop which was mostly impossible. It ended up in some HSTS file somewhere deep in the browsers cache files. Horrible technology.
- stanleydrew 4y agoI think you're just talking about aggressive browser caching of 301 responses, which isn't related to TLS or HSTS. It is pretty common to respond to plaintext HTTP requests with a 301 to the equivalent TLS URL, so I understand the confusion.
- VWWHFSfQ 4y agoIt's both the 301 and the server responds with the hsts header
- stanleydrew 4y agoWell yes it's common to return both, but the HSTS header explicitly has a max-age parameter so the browser is bound by the spec to enforce TLS connections until the max-age is reached. So when you say browsers would "require HTTPS for all of eternity" my assumption was that you didn't like the 301 caching.
- amichal 4y agoIts also this cache chrome://net-internals/#hsts (or other vendor equivalent)