4 ms·
You can't go back! As soon as a browser sees Strict-Transport-Security "max-age=31536000", it will refuse to load your site over HTTP for the next year. This s
by jackpirate 13y ago
You can't go back! As soon as a browser sees Strict-Transport-Security "max-age=31536000", it will refuse to load your site over HTTP for the next year.
This sounds like a powerful way to DOS a site if you can set up a temporary https server on the domain and send this signal.
- thirsteh 13y agoIt would be if SSL was expensive. It isn't.
- eridius 13y agoThe solution to that is every site should support HTTPS (or at least every site that has even the slightest risk that someone would want to do this to them).
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- schoen 13y agoThis DoS risk is documented in section 14.5 of the HSTS standard. https://tools.ietf.org/html/rfc6797#section-14.5 https://tools.ietf.org/html/rfc6797#section-14.5 It's true that HSTS could be a way for someone who can set up a seemingly valid but nonetheless fake HTTPS listener on a domain to prevent people from later communicating with a genuine HTTP service on that domain. Three remedies for this, with different degrees of applicability to different sites: * Put a CAA record for your domain into your DNS (see https://tools.ietf.org/html/rfc6844 https://tools.ietf.org/html/rfc6844) to prevent legitimate certificate authorities from issuing the cert to the impostor. (This only provides protection if the attacker doesn't control your DNS zone.) * Actually switch to HTTPS! * If this attack happens to you and you don't want to switch to HTTPS, run a legitimate HTTPS listener on your domain that clears the HSTS status and then redirects users back to HTTP.
- deleted 13y ago[deleted]