Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options answers only user 8340

HTTP Strict Transport Security is a mechanism enabling web sites to declare themselves accessible only via secure connections and/or for users to be able to direct their user agent(s) to interact with given sites only over secure connections. It is defined by RFC 6797.

2
votes
Only if the mixed content is on the same domain. If the HSTS policy is on https://example.com and this loads an image from http://example.org then mixed content will show. If however, the plain …
answered Apr 11 '16 by SilverlightFox
2
votes
this happens over HTTP and once the keys are shared and algorithms are decided further data will be encrypted but since in HSTS all data goes encrypted from the first request itself , so the … to negotiate SSL versions, ciphers and encryption keys. There is no requirement to have a plain HTTP service listening on your server. HSTS will simply force the browser to "remember" not to use plain HTTP on a domain - it does not affect the SSL handshake. …
answered May 12 '15 by SilverlightFox
0
votes
There's nothing to say that this HTTP response header should be sent for HTML content types only. As long as the header has a good chance of being received by the browser over HTTPS at the start of e …
answered May 25 '16 by SilverlightFox
3
votes
Yes, this should apply to all subdomains (see Steffen Ullrich's comment for caveat). In foo.bar.foobar, foo is a subdomain of bar.foobar, and bar is a subdomain of foobar, so therefore foo.bar.foobar …
answered May 26 '16 by SilverlightFox
6
votes
returned. So in your config you set *.google.com to the A record for www.google.com. Having said all this My conclusion: It doesn't work. If there is a HSTS rule on the browser already, the initial … request to www.google.com will be over HTTPS anyway meaning that it can't be intercepted by sslstrip. Additionally, if a site is in the HSTS preloaded list (like Google's domains will be in Chrome), it …
answered Jun 8 '15 by SilverlightFox
7
votes
should your site have some vulnerabilities that might not otherwise be able to be exploited: Session fixation: How can non-secure or non-HTTP-only cookie affect security of an HSTS website? XSS … cookie poisoning: Flash cookie and man-in-the-middle As well as the above, ssltrip style attacks can be carried out without HSTS. sslstrip relies to a degree on the user not noticing their is no HTTPS. Also see this answer. …
answered Jul 6 '16 by SilverlightFox
2
votes
HSTS (such as Internet Explorer 10). This would be a MITM attack on a normal HTTP connection to any server in order to redirect to the HTTP version of the domain and then intercept the sent cookies … . The Secure and HTTP Only cookies could be poisoned if the user hasn't yet visited the site in order for the HSTS policy to be set and the site isn't in the browser's preloaded list. This depends on what …
answered Sep 30 '14 by SilverlightFox
5
votes
Source: RFC 6797. The HSTS header is only valid when it is set over HTTPS. An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport. This is … because agents only respond to the HSTS header when a resource is served over TLS/SSL: If an HTTP response , received over a secure transport, includes an STS header field... [snip] Note …
answered Nov 2 '15 by SilverlightFox
11
votes
HSTS is enabled by returning the strict-transport-security header from a HTTPS response - the browser does not care whether this is set in PHP, by the server, or by a load balancer - as long as it … receives a valid header over HTTPS then HSTS will be enabled. You should be OK only returning this header from a single page for testing too. RFC 6797 states If a UA receives HTTP responses from a …
answered Nov 30 '13 by SilverlightFox