cisagov / cisagov/pshtt

Factor in redirects when calculating HSTS

Open
#89 16 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
693
Forks
91
PR merge metrics
No merged PRs in 30d

Description

I mentioned some of the set up to this problem in the TTS #https-partner-support Slack channel, but the long and the short of the issue is that in https://github.com/dhs-ncats/pshtt/blob/00ff246f40acbea185d478d838c7fcd6652b9aa8/pshtt/pshtt.py#L80 the check is being done on "not the final https URL" as best I can tell (possibly it's actually randomly doing this...).

So for instance, as I'm looking at lc.llnl.gov, the redirects are:

- http://lc.llnl.gov/
- https://lc.llnl.gov/
- https://lc.llnl.gov/nclogin.submit?LOGIN

And only the last hop (final URL) has the HSTS bits set up. This is the case for both lc.llnl.gov and lc-idm.llnl.gov, but for mylc.llnl.gov (which pshtt is currently saying is good for HSTS) the only difference I can find is in the middle hop:

- http://mylc.llnl.gov/
- https://lc.llnl.gov/lorenz
- https://lc.llnl.gov/nclogin.submit?LOGIN

Although, it also is not showing HSTS on the middle hop.

I'm still continuing to dig into this, but thought I would get the ticket opened while I work (since I still can't contribute directly yet).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.