Book Image

OpenStack Cloud Security

By : Fabio Alessandro Locati
Book Image

OpenStack Cloud Security

By: Fabio Alessandro Locati

Overview of this book

Table of Contents (14 chapters)
OpenStack Cloud Security
Credits
About the Author
About the Reviewers
www.PacktPub.com
Preface
Index

Enforcing HTTPS for future connections


It is possible to ask the browser to require HTTPS connections every time it accesses that specific domain for a certain period. This could be a dangerous option, since if SSL breaks on the server side, that domain will be inaccessible until SSL is restored properly. On the other hand, it really increases security, because after the first HTTPS connection, you are granted that until the end of the set period, all communications will be fully encrypted. To do this, it is enough to send an HTTP Header like the following one in the response:

Strict-Transport-Security: max-age=86400; includeSubDomains

This example will make this option last for 24 hours. This could be a good value for testing purposes, while it would be a good idea to set it to longer periods (1 month or 1 year) in production environments.