InformAction Forums

NoScript HTTPS Forcing When Not Forced ?

http://blog.mozilla.org/labs/files/2011/03/do_not_fool_workflow.png
Similarly you can end up with Forced Channel.

https://blog.mozilla.org/labs/2011/04/protecting-users-from-an-age-old-threat/
Yet: noscript.httpsForced; ?

Now the http: does automatically roll over to https:, in Mozilla, Safe Mode, showing a "lock", but not colored.
But in IE the http: does load & when you attempt to load the https:, you get an security certificate warning with an option to load anyway, which it will do.

Strict Transport Security

• max-age=15768000
• includeSubDomains

@dhouwn: Nice one .

With all of our client-side tools, it's easy to forget that there are server-side protections too .