Re: Redirects and HSTS

+sleevi

On Fri, Sep 26, 2014 at 2:24 PM, Anne van Kesteren <annevk@annevk.nl> wrote:

> On Fri, Sep 26, 2014 at 2:15 PM, Mike West <mkwst@google.com> wrote:
> > Yes, I think that's true.
>
> Perhaps Gecko's stance that HSTS rewriting happens after Mixed Content
> is correct. At least for non-same-origin HSTS. :-(
>

That's how Chrome implements it, actually. Ryan, et al, are dead-set
against moving HSTS before mixed content checking, as he claims (correctly)
that HSTS only protects those browsers that support it. If we don't throw
errors, we're throwing Safari and IE users under a bus.

-mike