Cannot redirect from /.well-known/security.txt

Nobody has claimed this yet.

It appears to not be possible to make /.well-known/security.txt redirect to https://vdp.cabinetoffice.gov.uk/.well-known/security.txt in line with https://gds-way.cloudapps.digital/standards/vulnerability-disclosure.html.

Configuring a redirect in either the global configuration file or the config.rb file as described at https://tdt-documentation.london.cloudapps.digital/maintain_project/redirects/ results in requests to /.well-known/security.txt being responded to with a text/plain response containing raw HTML:

              <html>
                <head>
                  <link rel="canonical" href="https://vdp.cabinetoffice.gov.uk/.well-known/security.txt" />
                  <meta http-equiv=refresh content="0; url=https://vdp.cabinetoffice.gov.uk/.well-known/security.txt" />
                  <meta name="robots" content="noindex,follow" />
                  <meta http-equiv="cache-control" content="no-cache" />
                </head>
                <body>
                </body>
              </html>

This seems to be because Middleman performs redirects by serving HTML pages with meta refreshes but the .txt file extension causes the HTML to be served with a text/plain content type.

It’s probably possible to get this working by editing the nginx.conf file but this does not seem this is intended to be modified by users of the Tech Docs Template gem.

The alternative is to serve the security.txt file directly rather than redirecting but this causes a maintenance headache.

Since there may be lots of tech docs sites that wish to redirect to https://vdp.cabinetoffice.gov.uk/.well-known/security.txt it makes sense for the gem to support this.

It might even make sense for the gem to always redirect requests for /.well-known/security.txt to https://vdp.cabinetoffice.gov.uk/.well-known/security.txt because most security vulnerabilities would probably be in the gem itself rather than any specific tech docs site that uses it. (This assumes that security reports for the gem should go through the Cabinet Office CDIO Cyber Security vulnerability disclosure programme.)

Reproduce the redirect configured through the global configuration or config.rb, then inspect the generated nginx.conf and the redirect behavior for /.well-known/security.txt. Confirm that the endpoint returns an HTTP redirect rather than raw HTML with a text/plain content type, and document or test the resulting response.

Written by the indexing model from the issue text.

Description

Contributor guide

First steps

Research direction

Assessment