The document discusses how Hypertext Transfer Protocol Strict Transport Security (HSTS) can improve security without reducing performance. HSTS helps secure connections by automatically converting HTTP requests to HTTPS. It reduces round trips by preventing insecure HTTP requests. The HSTS header instructs browsers to only access a site via HTTPS. HSTS is implemented through browser preloading and can include subdomains. Most new performance features like HTTP/2 require HTTPS, so HSTS helps enable these features and improved security.

1. HSTS: Improving Security Without Losing Performance
#CGNwebperf #25 Cologne, 6 December 2018
Ingo Steinke @fraktalisman
Sevenval Technologies GmbH
sevenval.com wao.io

2. HSTS: Improving Security Without Losing Performance
Hypertext
Strict
Transport
Security

3. ? HSTS
+
HTTP/2
+
TLS 1.3
+
Let’s Encrypt
(Ilya Grigorik, Velocity 2014) 2018
(Illustration © Jonathan Burton)

4. HSTS
Reduce
Round
Trips
307 Internal Redirect

5. HSTS Header
hstspreload.org
Strict-Transport-Security: max-age=31536000
HSTS Cache:
chrome://net-internals/hsts#hsts
HSTS Preload List

6. HSTS Header
Strict-Transport-Security:
max-age=31536000
includeSubDomains
http://old.legacy.domain.i.forgot.com/

7. HTTPS && B
HTTPS && Brotli
HTTPS && Brotli
Most new performance features require HTTPS.

8. Most new performance features require HTTPS.
S W
Image © Microsoft

9. HTTPS HSTS TLS 1.3 HTTP/2 HTTPS HSTS TLS 1.3 HTTP/2 HTTPS HSTS TLS 1.3
HTTP/2 HTTPS HSTS TLS 1.3 HTTP/2 HTTPS HSTS TLS 1.3 HTTP/2 HTTPS HSTS
TLS 1.3 HTTP/2 HTTPS HSTS TLS 1.3 HTTP/2 HTTPS HSTS TLS 1.3 HTTP/2 HTTPS
HSTS TLS 1.3 HTTP/2 HTTPS HSTS TLS 1.3 HTTP/2 HTTPS HSTS TLS 1.3 HTTP/2
HTTPS HSTS TLS 1.3 HTTP/2 HTTPS HSTS TLS 1.3 HTTP/2 HTTPS HSTS TLS 1.3
HTTPS HSTS TLS 1.3 HTTPS HSTS TLS 1.3 HTTPS HSTS TLS 1.3 HTTPS HSTS
TLS 1.3 HTTPS HSTS TLS 1.3 HTTPS HSTS TLS 1.3 HTTPS HSTS TLS 1.3 HTTPS
HSTS TLS 1.3 HTTPS HSTS TLS 1.3 HTTPS HSTS TLS 1.3 HTTPS HSTS TLS 1.3
do it yourself wao.io, cloudflare, ...
Just do it !
© IKEA

10. developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet
hstspreload.org
en.wikipedia.org/wiki/Brotli
istlsfastyet.com
blog.wao.io/tls-1-3
HSTS: Improving Security Without Losing Performance

11. HSTS: Improving Security Without Losing Performance
#CGNwebperf sevenval.com wao.io
Thanks! && Questions?