User:Apking/Web Security Guidelines: Difference between revisions

     <td style="white-space: nowrap;">__TOC__</td>

Transport Layer Security (TLS/SSL) provides assurances about the confidentiality, authentication, and integrity of all communications both inside and outside of Mozilla. To protect our users and networked systems, all systems must use encrypted TLS connections for their network communications.  Support and use of TLS is mandatory for all new systems, and existing systems are expected to add support for exclusive TLS as soon as possible.

Websites that require backwards compatibility with extremely old browsers may use the [[Security/Server Side TLS#Old backward compatibility|Mozilla backwards compatible TLS configuration]]. Very few sites should require this compatibility level, and use of this compatibility level should be noted in your risk assessment.

<tt>max-age</tt> must be set to a minimum of six months (15768000), but longer periods such as one year (31536000) or longer are also acceptable.  Note that once this value is set, the site must continue to support HTTPS until the expiry time has been reached.

<pre># Only connect to this site via HTTPS for the next six months

Strict-Transport-Security: max-age=15768000</pre>

<pre># Redirect from http to https with nginx

   return 301 https://$server_name$request_uri;

<pre># Redirect from http to https with Apache

Maximum risk sites must enable the use of HTTP Public Key Pinning (HPKP). HPKP instructs a user agent to bind a site to specific root certificate authority, intermediate certificate authority, or end-entity public key. This prevents  certificate authorities from issuing unauthorized certificates for a given domain that would nevertheless be trusted by the browsers. These fradulent certificates would allow an active attacker to MitM and impersonate a website, intercepting credentials and other sensitive data.