HSTS for Elixir with Phoenix: Practical Setup Guide
If you run a Phoenix app over HTTPS and you are not sending HSTS yet, you are leaving a pretty basic downgrade attack on the table. HSTS tells the browser: “Stop trying plain HTTP for this site. Use HTTPS only for a while.” That blocks SSL stripping and a bunch of accidental insecure requests after the first secure visit. Phoenix makes this easy, but there are a few sharp edges: ...