News for hackers. Stuff that matters.

A comment on Netflix and Fill. Parent comment

Re:Netflix and Fill by diggan on Thursday August 11, 2016 @12:34PM (#12269647)
This gets mentioned every time a blogpost from Netflix appears on HN. I've mentioned it too! https://news.ycombinator.com/item?id=12217900

According to kpcyrd, this is what happens: " I have the same issue, even though the link actually is http, my browser tries to open the https version, no matter what. It looks like https://netflix.com had hsts with includeSubdomains at one point in time which my browser has still cached. "

[ Parent | on HN ]
Re:Netflix and Fill by nathancahill on Thursday August 11, 2016 @01:13PM (#12269992)
Which is why you should only enable HSTS if you plan on supporting it permanently.
[ Parent | on HN ]
Re:Netflix and Fill by peterwwillis on Thursday August 11, 2016 @01:23PM (#12270065)
"But there's no reason to not use HTTPS! What could go wrong?"

But, you know... we have to secure our blog posts from MitM...

[ Parent | on HN ]
Re:Netflix and Fill by eterm on Thursday August 11, 2016 @04:12PM (#12271263)
No, you have to secure your blog posts because cookies against the top level domain can be in the request headers sent to the subdomain[1].

It's a bit bizarre you'd blame HTTPS, what is your alternative, don't use https?

[1] I say "can" because it depends on how the top level cookie is set, whether the browser respects the secure flag, and individual browser versions.

[ Parent | on HN ]