From: Daniel Stenberg <daniel@haxx.se>
Date: Wed, 10 Feb 2021 21:54:33 +0000 (+0100)
Subject: TODO: remove HSTS
X-Git-Tag: curl-7_76_0~168
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c386a0df441538ee4fbcf6e4bdac77abe5cc3e5d;p=thirdparty%2Fcurl.git

TODO: remove HSTS

Provided now since commit 7385610d0c74
---

diff --git a/docs/TODO b/docs/TODO
index 2f54085aa9..004b4e52a6 100644
--- a/docs/TODO
+++ b/docs/TODO
@@ -116,7 +116,6 @@
  13.9 TLS record padding
  13.10 Support Authority Information Access certificate extension (AIA)
  13.11 Support intermediate & root pinning for PINNEDPUBLICKEY
- 13.12 Support HSTS
  13.13 Make sure we forbid TLS 1.3 post-handshake authentication
  13.14 Support the clienthello extension
 
@@ -810,16 +809,6 @@
  Adding this feature would make curls pinning 100% compatible to HPKP and
  allow more flexible pinning.
 
-13.12 Support HSTS
-
- "HTTP Strict Transport Security" is TOFU (trust on first use), time-based
- features indicated by a HTTP header send by the webserver. It is widely used
- in browsers and it's purpose is to prevent insecure HTTP connections after a
- previous HTTPS connection. It protects against SSLStripping attacks.
-
- Doc: https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
- RFC 6797: https://tools.ietf.org/html/rfc6797
-
 13.13 Make sure we forbid TLS 1.3 post-handshake authentication
 
  RFC 8740 explains how using HTTP/2 must forbid the use of TLS 1.3