News for hackers. Stuff that matters.

A comment on HTTP Security Headers – A Complete Guide. Parent comment

Re:HTTP Security Headers – A Complete Guide by shawnz on Thursday July 18, 2019 @03:33PM (#20473185)
The scenario is assuming you have a working HSTS setup but then become unable to serve HTTPS for some reason (e.g. cert expires and you can't acquire a new one, or the provider just drops support for SSL for some reason, or you are forced to change providers to one that doesn't support SSL)

HSTS can't be enabled on plain HTTP so it's not possible to create the problematic scenario if you never had SSL enabled to begin with. The problem is switching from SSL to non-SSL, not the other way around.

[ Parent | on HN ]
Re:HTTP Security Headers – A Complete Guide by LinuxBender on Thursday July 18, 2019 @05:25PM (#20474062)
Even if you can't renew a cert you paid for, in most cases you should be able to get a temp cert from Lets Encrypt and renew it every couple of months. I have free wildcard certs for many of my domains. HSTS just requires HTTPS. It doesn't pin the cert to a particular CA. That is what CAA records are for.

Are you saying that you have applications that require HTTP port 80 only?

[ Parent | on HN ]
Re:HTTP Security Headers – A Complete Guide by shawnz on Thursday July 18, 2019 @05:37PM (#20474162)
It's true that letsencrypt makes this less likely to be an issue. But there is still the possibility that maybe your hosting provider drops support for HTTPS or you are forced to switch to a provider that doesn't support HTTPS. The parent gave one example of this with their GitHub Pages situation.

Also: HSTS applies to all ports once applied, not just 80/443. That is another important thing to consider before turning it on.

[ Parent | on HN ]