News for hackers. Stuff that matters.

A comment on Living with HTTPS. Parent comment

Re:Living with HTTPS by e1ven on Thursday July 19, 2012 @01:43PM (#4267154)
The STS header has an expiration date on it.

Let's assume you have it set to 1 year. If user A visits the site in March, receives the header, uses the site for a while.

In May, the site/user's DNS/whatever is hijacked. Users are sent to a dummy site, which does not set the header. The dummy site is over HTTP.

The next day, the user tries to go to the site. Because it is not over HTTPS, the browser refuses to load the page, even though the header is no longer sent.

[ Parent | on HN ]
Re:Living with HTTPS by bonzoesc on Thursday July 19, 2012 @02:22PM (#4267355) 

    strict-transport-security:max-age=2592000; includeSubDomains
It has a maximum age, not an expiration date. If I visit gmail today, that STS header will expire a month from now[1].

If I visit again tomorrow, the browser-cached version of that header will be updated with a new expiration date, and expire a month from tomorrow, not now.

1: http://www.wolframalpha.com/input/?i=2592000%20seconds

edit: I think we're agreeing.

[ Parent | on HN ]