HTTP Strict Transport Security becomes Internet Standard

ronjor · Nov 21, 2012

The Internet Engineering Task Force (IETF) has published RFC 6797, formally declaring the HTTP Strict Transport Security (HSTS) security mechanism for HTTPS as an Internet Standard. HSTS is designed to allow (HTTP) servers to ensure that any services offered can only be accessed via secure connections that are encrypted using mechanisms such as Transport Layer Security (TLS). From a client perspective, HSTS forces applications (User Agents) to only use encrypted connections when communicating with web sites. Sites such as the Open Web Application Security Project's describe how to implement the use of HSTS in web servers such as Apache, Nginx and Lighttpd.
Click to expand...

http://www.h-online.com/security/ne...curity-becomes-Internet-Standard-1754549.html

elapsed · Nov 21, 2012

Great news, also the fact that we didn't have to wait ~10 years for it to happen.

Hungry Man · Nov 21, 2012

Does IE10 even support it yet?

https://www.owasp.org/index.php/HTTP_Strict_Transport_Security#Browser_Support

That says no but it might be outdated.

Still, nice that it's officially a standard.

Log in or Sign up

HTTP Strict Transport Security becomes Internet Standard

ronjor Global Moderator

elapsed Registered Member

Hungry Man Registered Member

Log in or Sign up

HTTP Strict Transport Security becomes Internet Standard

ronjor Global Moderator

elapsed Registered Member

Hungry Man Registered Member

Useful Searches