Http-Security

A lot of teams treat Server-Sent Events like “just another endpoint.” That’s how you end up with a perfectly secure app shell over HTTPS and a quietly fragile event stream still hanging onto old HTTP assumptions. I’ve seen this play out in production: the page loads fine, login works, API calls are on HTTPS, HSTS is enabled on the main site, and yet live updates randomly fail, especially after deploys, browser restarts, or when users hit older bookmarked URLs. The culprit was SSE over an incomplete HTTPS setup. ...

A few years ago I watched a team turn on HSTS in production with a one-line config change and a lot of confidence. By lunch, support had a queue full of users who couldn’t reach a legacy upload app on a forgotten subdomain. By the end of the day, the team had learned the hard way that HSTS is easy to enable and surprisingly hard to roll back once browsers cache it. ...

HTTP Strict Transport Security is one of those headers that looks trivial and still gets deployed wrong all the time. If you run a Nim app with Jester, HSTS is easy to add. The hard part is adding it in the right place, with the right conditions, and without bricking a staging domain or forcing bad HTTPS assumptions behind a reverse proxy. HSTS tells the browser: only use HTTPS for this site keep doing that for a specific amount of time optionally apply the rule to subdomains optionally treat the domain as preload-eligible The header looks like this: ...