3 ms·
> 1. You can't go back! As soon as a browser sees Strict-Transport-Security "max-age=31536000", it will refuse to load your site over HTTP for the next year. I
by notJim 13y ago
> 1. You can't go back! As soon as a browser sees Strict-Transport-Security "max-age=31536000", it will refuse to load your site over HTTP for the next year.
Is this true? What if you send a new header with a max-age of 1 second, or send one with a garbage value?
I'm pretty sure I've seen a way for a website to disable HSTS, but I can't confirm right now.
- hdevalence 13y agoAs per the spec, setting max-age=0 disables HSTS.
- deathanatos 13y agoYes, but you'd have to serve that over HTTPS. And even then, how do you know that all the caches that have the older, longer expiration time have revisited and updated their cache? You won't, really, until that many seconds have pass.
- hdevalence 13y agoRight, my point was just that there is a specified way for the server to tell the client not to use HSTS any more. Of course, the caveats you mention mean that to be certain, you would need to wait.