3 ms·
> sites are protected not only wity TLS but also HSTS and the list goes on. HSTS is just what says for the browser not even try HTTP connection, but directly H
by jve 4y ago
> sites are protected not only wity TLS but also HSTS and the list goes on.
HSTS is just what says for the browser not even try HTTP connection, but directly HTTPS.
- maerF0x0 4y agoand also to report an error if there's a redirect back to HTTP, right? ie when a MITM is attempting to drop you back to insecure.
- hinata08 4y agoyes. if HSTS is implemented properly, it won't just report an error, but it will also forbid any connection. For example, on Firefox, you can't bypass an HSTS error. The browser won't let you add an exception to connect to the site. (you have to purge your data to connect again 'for the first time' on the site)