Open
Bug 643900
Opened 14 years ago
Updated 2 years ago
Enabling HSTS for a site doesn't force safe renegotiation to be required for the site
Categories
(Core :: Security: PSM, defect, P5)
Core
Security: PSM
Tracking
()
NEW
People
(Reporter: briansmith, Unassigned)
References
(Blocks 1 open bug)
Details
(Whiteboard: [psm-backlog])
For HSTS sites, we should ignore all user-set options related to safe renegotiation and instead always use the strictest options for them.
|
Reporter | |
Comment 1•10 years ago
|
||
(In reply to Brian Smith (:briansmith, :bsmith, use NEEDINFO?) from comment #0)
> For HSTS sites, we should ignore all user-set options related to safe
> renegotiation and instead always use the strictest options for them.
...and/or refuse renegotiation requests for HSTS domains when the secure renegotiation extension wasn't negotiated.
Whiteboard: [psm-backlog]
Priority: -- → P5
|
||
Updated•2 years ago
|
Severity: normal → S3
You need to log in
before you can comment on or make changes to this bug.
Description
•