67
edits
WebAppSec/MozSecureWorld: Difference between revisions
Jump to navigation
Jump to search
→Calendar
| Line 220: | Line 220: | ||
** Have strict transport security header stuff | ** Have strict transport security header stuff | ||
** Read [http://michael-coates.blogspot.com/2011/07/enhancing-secure-communications-with.html Michael's blog about it] | ** Read [http://michael-coates.blogspot.com/2011/07/enhancing-secure-communications-with.html Michael's blog about it] | ||
** Read [https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet OWASP TLS] | |||
** Read [http://www.slideshare.net/michael_coates/ssl-screw-ups understand problem= | |||
** click around burp should show no HTTP anytime | ** click around burp should show no HTTP anytime | ||
* Only SSL, all scripts, img, SSL everything SSL, | |||
* On top, do STS (Strict Transport Security) --> for browser | |||
* secure flag for all cookies | |||
</td> | </td> | ||
<td></td> | <td></td> | ||