News for hackers. Stuff that matters.

A comment on HTTP headers for the responsible developer. Parent comment

Re:HTTP headers for the responsible developer by LeonM on Wednesday May 08, 2019 @09:02AM (#19858419)
> and then asking for urgent consultancy to fix it.

If it is preloaded (as the article suggest you should do), there is nothing you can do to 'fix' it, except migrating all other subdomains to HTTPS. Which is not always possible.

[ Parent | on HN ]
Re:HTTP headers for the responsible developer by nolok on Wednesday May 08, 2019 @09:30AM (#19858614)
Oh yes exactly, especially since they don't have much planned budget for it (small firms) it ends either with a lot of dirty proxying to have an HTTPS middle point, just because someone screwed up without paying attention to what they were actually doing, or with a secondary domain for the office.
[ Parent | on HN ]