Browser security: Difference between revisions
Jump to navigation
Jump to search
| Line 16: | Line 16: | ||
==Definition== | ==Definition== | ||
*max-age, the period for which insecure requests cannot be made, units in seconds | *max-age, the period for which insecure requests cannot be made, units in seconds | ||
*includeSubdomains, | *includeSubdomains, include subdomains | ||
*preload, this is used to have your site submitted for preload | |||
=HTTP Public Key Pinning (HPKP)= | =HTTP Public Key Pinning (HPKP)= | ||
Latest revision as of 06:14, 4 September 2020
Resources
- https://caniuse.com/ great for seeing usage across browsers
HTTP Strict Transport Security (HSTS)
Set up Apache HSTS
In Apache 2 000-default.conf
<VirtualHost *:80>
ServerName example.com
Redirect permanent / https://example.com/
</VirtualHost>
In Apache 2 default-ssl.conf
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"
Definition
- max-age, the period for which insecure requests cannot be made, units in seconds
- includeSubdomains, include subdomains
- preload, this is used to have your site submitted for preload