cisagov / cisagov/pshtt

Consider factoring in meta refresh tags when calculating redirects

Open
#52 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
693
Forks
91
PR merge metrics
No merged PRs in 30d

Description

Not necessarily for relaxing compliance standards around using server-side 80->443 redirects, but just to detect a broader swathe of agency behavior.

For example, segurosocial.gov seems to redirect to socialsecurity.gov, but it actually uses a `` tag to do the refresh. And further, it redirects to an insecure URL:

```
curl https://segurosocial.gov
```

```html

SEGUROSOCIAL

```

However, this doesn't show up in `pshtt` at all, so there's no way to detect this kind of thing.

It'd be a new thing to look at (and parse) HTML content instead of just HTTP headers and status codes, but if it's simple enough, it may be worth it, and offering a new field or set of fields (separate from the fields there now for server redirects) for downstream tools who care about them.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.