News for hackers. Stuff that matters.

A comment on HTTP Security Headers – A Complete Guide. Parent comment

Re:HTTP Security Headers – A Complete Guide by eropple on Thursday July 18, 2019 @04:45PM (#20473761)
In what situation that you can conjure up is being forcibly reduced to HTTP distinguishable from being down?

Like, how does it happen, ever?

And what happens to your users' credentials if you do?

[ Parent | on HN ]
Re:HTTP Security Headers – A Complete Guide by _b8r0 on Friday July 19, 2019 @05:37AM (#20477252)
When you have publicly accessible resources that must be available to all, but you can't guarantee that the accessing systems are configured correctly to use HTTPS.

There are plenty of scenarios in which this happens online:

* Legacy systems (e.g. Aminet)

* Software distribution (e.g. apt mirrors)

* Anything involving FTP where a HTTP mirror would be useful (e.g. overcoming FW restrictions)

* Anything where permissionless access is a requirement (HTTPS is a permissioned system)

[ Parent | on HN ]