cisagov / cisagov/pshtt

Incorrect calculation for "Enforces HTTPS"

Open
#207 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
693
Forks
91
PR merge metrics
No merged PRs in 30d

Description

# 🐛 Bug Report

A clear and concise description of what the bug is.

## To Reproduce

Steps to reproduce the behavior:

Install pshtt on CentOS 7.7.
Run test against desired site with known Valid HTTPS and Defaults to HTTPS

## Expected behavior

A given site returns "Valid HTTPS=True" and "Defaults to HTTPS=True", so "Domain Enforces HTTPS" should be True.

I support a federal agency...according to what's been published, pshtt is supposed to calculate "Domain Enforces HTTPS" based on (Domain Supports HTTPS=True AND (Defaults to HTTPS=True OR (Strictly Forces HTTPS=True AND Redirect=True))). If this logic is correct, then any domain with Valid HTTPS=True and Defaults to HTTPS=True should return True for Domain Enforces HTTPS, regardless of the values for Strictly Forces HTTPS and Redirect.

Test site was "list.ahrq.gov".

## Any helpful log output

Paste the results here:

```bash

```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.