cisagov / cisagov/pshtt

BOD 18-01 Compliance Discrepancies

Open
#258 2 comments 0 reactions 2 assignees Claimed by @jsf9k View on GitHub
bug
Dominant language
Python
Stars
693
Forks
91
PR merge metrics
No merged PRs in 30d

Description

# 🐛 Summary #

The automated PSHTT scanner used for BOD web compliance checks is showing a few domains as having "hsts" = "false" and "hsts_max_age" = -1, when they otherwise appear to have HSTS header with a valid age. While the automated checks used for the HTTPS report shows non-compliance, using the PSHTT scanner locally returns expected HSTS results for the same domain and shows compliance.

## To reproduce ##

Steps to reproduce the behavior:

1. Determine domain not returning expected HSTS results from the weekly results
2. Review results for said domain within the HTTPS report and note non-compliance with HSTS checks
3. Run PSHTT scans using Docker, "cisagov/domain-scan:latest --scan=pshtt"
4. Note compliant HSTS headers on Docker scan vs. non-compliant HSTS headers on automated scan

## Expected behavior ##

BOD reports to match what is detected via the manual "pshtt" checks.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.