Certificate

# ===== 1) HSTS — force HTTPS for every future visit =====
# Response header
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

# Why it matters for XSS:
# An attacker on the same network can serve a fake HTTP page that injects
# scripts. HSTS makes the browser refuse to even ATTEMPT HTTP after the
# first secure visit. preload pre-registers the domain so the FIRST visit
# is also HTTPS-only.

# Submit your apex domain to:
#   https://hstspreload.org/

# nginx example
# add_header Strict-Transport-Security 'max-age=63072000; includeSubDomains; preload' always;

# Laravel middleware
# class HstsMiddleware {
#   public function handle($req, $next) {
#     $res = $next($req);
#     $res->headers->set('Strict-Transport-Security',
#       'max-age=63072000; includeSubDomains; preload');
#     return $res;
#   }
# }

# ===== 2) Mixed content blocking =====
# Modern browsers refuse to load:
#   - HTTP scripts / iframes / WebSocket from an HTTPS page (BLOCKED outright)
#   - HTTP images / media from an HTTPS page (upgraded automatically, sometimes blocked)
#
# You enforce 'no mixed content' with Content-Security-Policy:
Content-Security-Policy: upgrade-insecure-requests; default-src 'self' https:; img-src 'self' https: data:;
#
# 'upgrade-insecure-requests' rewrites http:// to https:// at fetch time.

# ===== 3) Certificate validity =====
# Expired or self-signed certs trigger an interstitial. Users CAN click through —
# do not let your monitoring depend on them not clicking through.
# - Use Let's Encrypt + a renewal cron OR a managed CDN (Cloudflare, AWS) that
#   auto-renews
# - Monitor TLS expiry centrally; alert at 14 days remaining

# ===== 4) Certificate pinning (mobile + SPA) =====
# Native apps can pin the public key of the server cert so a network attacker
# with a 'valid for the device' cert (from a corp MITM proxy or compromised CA)
# is rejected.
#
# iOS (URLSession)
# func urlSession(_ session: URLSession, didReceive challenge: URLAuthenticationChallenge,
#                 completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
#   let pinnedHash = 'sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='
#   // compute hash of public key, compare; reject if mismatch
# }
#
# Android (OkHttp)
# val pinner = CertificatePinner.Builder()
#   .add('api.example.com', 'sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=')
#   .build()
# val client = OkHttpClient.Builder().certificatePinner(pinner).build()
#
# Pinning rotation: ship at least TWO pins (current + next) so you can rotate
# without bricking the app.

# ===== 5) Public-Key Pinning headers (HPKP) — DEPRECATED =====
# Browsers removed HPKP because misconfigurations bricked sites for months.
# For HTTPS pinning, use:
#   - Expect-CT (also deprecated but still informational)
#   - Certificate Transparency monitoring
#   - HSTS preload + a managed CA + Certificate Transparency monitors

# ===== 6) Certificate Transparency monitoring =====
# CT logs every cert issued for your domain. Subscribe to alerts so you find out
# the moment a rogue cert is minted (compromised CA, mis-issuance, social
# engineering at a CA).
# Free monitoring: Cert Spotter, crt.sh email alerts, Cloudflare CT monitoring.

# ===== 7) Tying this back to XSS =====
# The threat model is the WHOLE chain:
#   downgrade -> inject -> exfil
# HSTS removes the downgrade step on every visit after the first.
# upgrade-insecure-requests removes mixed-content footholds.
# Pinning + CT monitoring close the 'attacker gets a valid cert' branch.
# Without these, even a perfect output-encoding story can be bypassed on hostile
# networks (cafe Wi-Fi, hotel captive portal, compromised carrier).

# Decision tree
# - Public web app:          HSTS preload + upgrade-insecure-requests
# - Mobile app:              + certificate pinning with two pins
# - Anything money-touching: + Certificate Transparency monitoring

// /certificate/xss