3 ms·
HTTP Strict Transport Security solves this.
by stouset 14y ago
HTTP Strict Transport Security solves this.
- just2n 14y agoThat only works if the user makes an https request first. Say the URL is: https://mybank.com https://mybank.com, but I go to http://mybank.com http://mybank.com, and I haven't been there yet, so the STS rule isn't in my browser. How can a user reliably be switched to https without risk of having the connection hijacked by someone injecting code to the user?