Re: [whatwg/fetch] Clarification on CORS preflight fetches for TLS client certificates (#869)

alexiade left a comment (whatwg/fetch#869)

@thw0rted . HSTS is just an HTTP response header — a policy — that says "for this domain, always use TLS (HTTPS), never fall back to plaintext, and don't let the user click through cert errors." It doesn't encrypt or authenticate anything; it just tells the browser a rule about when to insist on TLS. The thing doing the work is still TLS and mTLS is just a bilateral trust version of it. HSTS is a stickinote that the door must be locked. TLS is the lock. 

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/869#issuecomment-4697767619
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/869/4697767619@github.com>