HTTPS and TLS

HTTPS is HTTP carried over TLS, which provides confidentiality, integrity, and server authentication for the connection.

Use valid certificates, modern TLS, secure redirects, and HSTS. TLS protects the connection, not secrets placed in URLs, logs, or response bodies.

httpsecuritytlshttps

Reference (http)

https://example.com
Strict-Transport-Security: max-age=31536000; includeSubDomains

Use valid certificates, modern TLS, secure redirects, and HSTS. TLS protects the connection, not secrets placed in URLs, logs, or response bodies.

Common mistakes

Assuming HTTPS makes unsafe application behavior safe or forgetting to protect cookies and URLs as well.

Sources