News for hackers. Stuff that matters.

A comment on HTTP headers for the responsible developer. Parent comment

Re:HTTP headers for the responsible developer by LeonM on Wednesday May 08, 2019 @09:00AM (#19858401)
> Instead of using HSTS, you can also simply redirect any HTTP request to HTTPS

I think this comment sums up my whole point about how less experienced developers must learn how to use headers.

Like others have commented, HSTS is used to fix potential dangers in forwarding (MITM attacks), it also reduces overhead.

> That way, you are certain that HTTPS is used, even if a browser does not understand HSTS.

If you use HSTS, you should always use a 301 permanent redirect as a fallback method for old browsers and other HTTP clients (like some libCurl implementations).

[ Parent | on HN ]
Re:HTTP headers for the responsible developer by amelius on Wednesday May 08, 2019 @10:16AM (#19858967)
I think what this comment thread really says is that the burden of fixing mistakes in the web's fundamental design is put on the individual developer and that this is another mistake!

If MITM is a serious issue then it's an extremely bad idea to depend on individual developers of every website out there to mitigate this.

[ Parent | on HN ]
Re:HTTP headers for the responsible developer by majewsky on Wednesday May 08, 2019 @02:50PM (#19861766)
Everything else is just wishful thinking, though. Chrome cannot decide to just deprecate (e.g.) unsafe-inline CSS tags. It would break 90% of websites, and people would move to a different browser to get their websites to work.
[ Parent | on HN ]