3 ms·
How would that even work? It's up to the developer to consider the response and act correctly on it.
by g15jv2dp 2y ago
How would that even work? It's up to the developer to consider the response and act correctly on it.
- Aachen 2y agoSame way as TLS session resumption can be handled by libraries without you having to touch it, or perhaps requiring you to specify a storage file and taking it from there
- andersa 2y agoJust do it like a web browser - when you install Chrome it comes with a list of many tens of thousands of domains that had HSTS set when GoogleBot visited it.
- akira2501 2y agoSo if you occasionally forget and use http when you meant https and are worried about the consequences of that, you should just implement your own HSTS checking layer? Why not just implement your own fetch wrapper that throws if it's not an https connection?
- g15jv2dp 2y ago> So if you occasionally forget and use http when you meant https and are worried about the consequences of that, you should just implement your own HSTS checking layer? Or use a library to do it. The core fetch functionality shouldn't have to deal with HSTS. There may be legitimate reasons to fetch over HTTP even after you received an HSTS header - for testing purposes, for example. > Why not just implement your own fetch wrapper that throws if it's not an https connection? That's the developer dealing with HSTS.