cisagov / cisagov/pshtt

'Valid HTTPS' key-value inconsistent across platforms

Open
#149 17 comments 0 reactions 1 assignee Claimed by @jsf9k View on GitHub
bug
Dominant language
Python
Stars
693
Forks
91
PR merge metrics
No merged PRs in 30d

Description

We are utilizing the pshtt module to determine M-15-13 compliance for certain websites. We are running pshtt off of a python script that is invoking the 'inspect_domains' method to get all relevant results. As part of our testing we have been running the same method in multiple places, namely our local machine and our cloud instances (the pshtt versions are the same on both), additionally, we are also running tests by calling 'pshtt' directly from bash. In all three examples, we are seeing different results for a couple of specific 'key-value' pairs. Provided below is one example of the issues we are facing.

www.worklife4you.com - for this domain we are seeing three different Boolean values for 'Valid HTTPS'.

* 'pshtt.inspect_domain' method in a python script running locally returns 'None' for 'Valid HTTPS'.
* running pshtt directly off the bash CLI returns 'False' for 'Valid HTTPS'.
* running the scan from our cloud instance returns 'True' for 'Valid HTTPS'.
* What's really strange about this is that it's the same 'pshtt.inspect_domains' method we are running locally, in this application, it's just wrapped in an EC2 instance. The pshtt version is also up-to-date in the cloud (v.0.3.0) and is the same version as in our local machine (v.0.3.0)

Thank you so much for helping us out with this.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.