4 ms·
The STS header has an expiration date on it. Let's assume you have it set to 1 year. If user A visits the site in March, receives the header, uses the site for
by e1ven 14y ago
The STS header has an expiration date on it.
Let's assume you have it set to 1 year.
If user A visits the site in March, receives the header, uses the site for a while.
In May, the site/user's DNS/whatever is hijacked. Users are sent to a dummy site, which does not set the header. The dummy site is over HTTP.
The next day, the user tries to go to the site. Because it is not over HTTPS, the browser refuses to load the page, even though the header is no longer sent.
- bonzoesc 14y agostrict-transport-security:max-age=2592000; includeSubDomains It has a maximum age, not an expiration date. If I visit gmail today, that STS header will expire a month from now[1]. If I visit again tomorrow, the browser-cached version of that header will be updated with a new expiration date, and expire a month from tomorrow, not now. 1: http://www.wolframalpha.com/input/?i=2592000%20seconds http://www.wolframalpha.com/input/?i=2592000%20seconds edit: I think we're agreeing.