BOD 18-01 Compliance Discrepancies
- Dominant language
- Python
- Stars
- 693
- Forks
- 91
- PR merge metrics
- No merged PRs in 30d
Description
# 🐛 Summary #
The automated PSHTT scanner used for BOD web compliance checks is showing a few domains as having "hsts" = "false" and "hsts_max_age" = -1, when they otherwise appear to have HSTS header with a valid age. While the automated checks used for the HTTPS report shows non-compliance, using the PSHTT scanner locally returns expected HSTS results for the same domain and shows compliance.
## To reproduce ##
Steps to reproduce the behavior:
1. Determine domain not returning expected HSTS results from the weekly results
2. Review results for said domain within the HTTPS report and note non-compliance with HSTS checks
3. Run PSHTT scans using Docker, "cisagov/domain-scan:latest --scan=pshtt"
4. Note compliant HSTS headers on Docker scan vs. non-compliant HSTS headers on automated scan
## Expected behavior ##
BOD reports to match what is detected via the manual "pshtt" checks.
Contributor guide
Assessment
This issue has not been assessed yet.