HSTS support

[Cantor, Scott]

On 2/18/15, 5:42 PM, "Christopher Bongaarts" <cab at umn.edu> wrote:



>On 2/18/2015 11:38 AM, Ian Young wrote:
>> I was thinking about supporting HTTP Strict Transport Security on my 
>>IdP. I do this elsewhere and it's a fairly simple set-a-header operation 
>>in things like Apache.
>
>Main thing keeping me away from it is that it prevents the user from 
>overriding the SSL warning if you try to connect directly to one server 
>behind a load balancer and the SSL cert does not contain the "real" 
>server name.

That would also prevent bypassing the CA mafia in general, which makes me 
question the motives of the people who created it.

Anyway, there's no way to do it without us adding code. You would 
basically add a filter, which can be done locally in your own edit-webapp 
tree of course.

-- Scott