Ask HN: Why would using HSTS be a disadvantage?

2 pointsby kaushiktvor 6 Jahren1 comments

I came across this well written post about some of the dangers of HSTS - https://www.tunetheweb.com/blog/dangerous-web-security-features/#:~:text=I%20like%20HSTS%2C%20I%20think,slowly%2C%20you%20should%20be%20ok.

Even on Cloudflare, when you enable HSTS, it gives you a warning.

Generally, I have researched and learnt that HSTS is important to get secure by forcing all communications to happen via HTTPS.

So, why is everyone still giving so many warnings? Do orgs have a lot of HTTP setup for let's say their APIs or legacy codes still supporting HTTP?

1 comments

detarovor 6 Jahren

> I came across this well written post about some of the dangers of HSTS [...]

Doesn't the article give a good explanation of why it recommends caution?