3 ms·
I have a question about HSTS (Strict-Transport-Security). This quote is from "Mozilla Developer Network" [1]: "The HTTP Strict Transport Security feature lets
by slashdotaccount 13y ago
I have a question about HSTS (Strict-Transport-Security).
This quote is from "Mozilla Developer Network" [1]:
"The HTTP Strict Transport Security feature lets a web site inform the browser that it should never load the site using HTTP, and should automatically convert all attempts to access the site using HTTP to HTTPS requests instead."
Does this mean that the browser stores somewhere that the site foo.com must be opened only in HTTPS mode? And what if I don't want the browser to keep any information about any site - its favicon, its cookies, local storage, indexed databases or HSTS information, nothing, how can I achieve this? Does the private mode in Firefox do this?
[1] https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security https://developer.mozilla.org/en-US/docs/Security/HTTP_Stric...
- ivanr 13y agoThere are two ways in which HSTS is deployed. First, it is activated when the HSTS response header is sent by the site. Normally, the browser will remember the HSTS response for a period of time. Clearly, a correctly implemented private mode breaks this, and thus breaks HSTS. However, Google and Mozilla are also pre-loading HSTS information. There was a blog post from Mozilla some months ago, describing how they have a crawler that detects long-term HSTS configuration in popular sites and then ships that information with browser releases. In this case, HSTS will work as intended even in private mode.