News for hackers. Stuff that matters.

A comment on HTTP Security Headers – A Complete Guide. Parent comment

Re:HTTP Security Headers – A Complete Guide by brlewis on Thursday July 18, 2019 @12:53PM (#20471685)
If you don't use HSTS, you have to be _really_ sure that _all_ your users fully understand the risks of using an unencrypted connection.

In the example you gave, wouldn't you have lost all your work anyway without HSTS? I don't think browsers supply an easy way to retry POST to the corresponding http: URL whether HSTS is set up or not.

[ Parent | on HN ]
Re:HTTP Security Headers – A Complete Guide by half-kh-hacker on Thursday July 18, 2019 @01:57PM (#20472330)
Without HSTS, you can inspect the cert and click through the invalid certificate warning.

With HSTS, that button goes away in browsers.

[ Parent | on HN ]