I was looking at the HTTP responses form https://twitter.com and https://encrypted.google.com. These two responses have interesting similarities and differences in their security definitions. Both ...
I want to trial a HSTS policy on my blog without enabling it site wide initially. As a HSTS policy is just a HTTP response header would there be any problem with sending the header in PHP like so: ...
Is the Strict-Transport-Security header intended for HTTP or HTTPS? What I mean is, do I respond with this header on a HTTP connection which in turn tells the browser to use HTTPS only from that point ...
HTTP Strict Transport Security (HSTS) is a very useful feature at preventing OWASP a9 violations and attacks like SSLStrip which try and prevent the client from making a secure connection. My ...