3 ms·
I think you're just talking about aggressive browser caching of 301 responses, which isn't related to TLS or HSTS. It is pretty common to respond to plaintext H
by stanleydrew 4y ago
I think you're just talking about aggressive browser caching of 301 responses, which isn't related to TLS or HSTS. It is pretty common to respond to plaintext HTTP requests with a 301 to the equivalent TLS URL, so I understand the confusion.
- VWWHFSfQ 4y agoIt's both the 301 and the server responds with the hsts header
- stanleydrew 4y agoWell yes it's common to return both, but the HSTS header explicitly has a max-age parameter so the browser is bound by the spec to enforce TLS connections until the max-age is reached. So when you say browsers would "require HTTPS for all of eternity" my assumption was that you didn't like the 301 caching.
- amichal 4y agoIts also this cache chrome://net-internals/#hsts (or other vendor equivalent)