CS_learn/how-web-works
1
0
Fork 0
mirror of https://github.com/vasanthk/how-web-works.git synced 2026-02-13 23:25:45 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: sintax to strikethrough was wrong

Browse Source
This commit is contained in:
Radamés Roriz
2022-02-21 18:33:23 -03:00
committed by GitHub
parent 4118298c25
commit 815c2fcb03
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
README.md
View File

@@ -56,12 +56,13 @@ The browser now has the following information contained in the URL (Uniform Reso
When no protocol or valid domain name is given the browser proceeds to feed the text given in the address box to the browser's default web search engine.
## Check HSTS list (deprected)
~~
* The browser checks its "preloaded HSTS (HTTP Strict Transport Security)" list. This is a list of websites that have requested to be contacted via HTTPS only.
* If the website is in the list, the browser sends its request via HTTPS instead of HTTP. Otherwise, the initial request is sent via HTTP.
Note: The website can still use the HSTS policy without being in the HSTS list. The first HTTP request to the website by a user will receive a response requesting that the user only send HTTPS requests. However, this single HTTP request could potentially leave the user vulnerable to a [downgrade attack](http://www.yourdictionary.com/downgrade-attack), which is why the HSTS list is included in modern web browsers.
~~* The browser checks its "preloaded HSTS (HTTP Strict Transport Security)" list. This is a list of websites that have requested to be contacted via HTTPS only.
~* If the website is in the list, the browser sends its request via HTTPS instead of HTTP. Otherwise, the initial request is sent via HTTP.
~
~Note: The website can still use the HSTS policy without being in the HSTS list. The first HTTP request to the website by a user will receive a response requesting that the user only send HTTPS requests. However, this single HTTP request could potentially leave the user vulnerable to a [downgrade attack](http://www.yourdictionary.com/downgrade-attack), which is why the HSTS list is included in modern web browsers.
~~
Modern browsers requests https first