CS_learn/how-web-works
1
0
Fork 0
mirror of https://github.com/vasanthk/how-web-works.git synced 2026-06-16 15:06:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #11 from nuriakman/patch-1

Browse Source 
Fix markdown code
This commit is contained in:
Vasa
2022-03-03 20:18:14 -08:00
committed by GitHub
parent 0f08625923 e2d563b815
commit dae9377d82
1 changed files with 4 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
README.md
View File

@@ -57,11 +57,10 @@ When no protocol or valid domain name is given the browser proceeds to feed the
## Check HSTS list (deprected)
~~* The browser checks its "preloaded HSTS (HTTP Strict Transport Security)" list. This is a list of websites that have requested to be contacted via HTTPS only.
~* If the website is in the list, the browser sends its request via HTTPS instead of HTTP. Otherwise, the initial request is sent via HTTP.
~
~Note: The website can still use the HSTS policy without being in the HSTS list. The first HTTP request to the website by a user will receive a response requesting that the user only send HTTPS requests. However, this single HTTP request could potentially leave the user vulnerable to a [downgrade attack](http://www.yourdictionary.com/downgrade-attack), which is why the HSTS list is included in modern web browsers.
~~
* ~The browser checks its "preloaded HSTS (HTTP Strict Transport Security)" list. This is a list of websites that have requested to be contacted via HTTPS only.~
* ~If the website is in the list, the browser sends its request via HTTPS instead of HTTP. Otherwise, the initial request is sent via HTTP.~
Note: The website can still use the HSTS policy without being in the HSTS list. The first HTTP request to the website by a user will receive a response requesting that the user only send HTTPS requests. However, this single HTTP request could potentially leave the user vulnerable to a [downgrade attack](http://www.yourdictionary.com/downgrade-attack), which is why the HSTS list is included in modern web browsers.
Modern browsers requests https first