Hacker News Reader

I don't know if it's still the case, but it used to be that if you accidently set a localhost webserver to redirect to HTTPS while you were developing then browsers would remember that and from then on require HTTPS for all of eternity until you could figure out how to make it stop which was mostly impossible. It ended up in some HSTS file somewhere deep in the browsers cache files. Horrible technology.

View on HN

I think you're just talking about aggressive browser caching of 301 responses, which isn't related to TLS or HSTS. It is pretty common to respond to plaintext HTTP requests with a 301 to the equivalent TLS URL, so I understand the confusion.

It's both the 301 and the server responds with the hsts header

Well yes it's common to return both, but the HSTS header explicitly has a max-age parameter so the browser is bound by the spec to enforce TLS connections until the max-age is reached. So when you say browsers would "require HTTPS for all of eternity" my assumption was that you didn't like the 301 caching.

Its also this cache chrome://net-internals/#hsts (or other vendor equivalent)

Reply on news.ycombinator.com