Factor in redirects when calculating HSTS
- Dominant language
- Python
- Stars
- 693
- Forks
- 91
- PR merge metrics
- No merged PRs in 30d
Description
I mentioned some of the set up to this problem in the TTS #https-partner-support Slack channel, but the long and the short of the issue is that in https://github.com/dhs-ncats/pshtt/blob/00ff246f40acbea185d478d838c7fcd6652b9aa8/pshtt/pshtt.py#L80 the check is being done on "not the final https URL" as best I can tell (possibly it's actually randomly doing this...).
So for instance, as I'm looking at lc.llnl.gov, the redirects are:
- http://lc.llnl.gov/
- https://lc.llnl.gov/
- https://lc.llnl.gov/nclogin.submit?LOGIN
And only the last hop (final URL) has the HSTS bits set up. This is the case for both lc.llnl.gov and lc-idm.llnl.gov, but for mylc.llnl.gov (which pshtt is currently saying is good for HSTS) the only difference I can find is in the middle hop:
- http://mylc.llnl.gov/
- https://lc.llnl.gov/lorenz
- https://lc.llnl.gov/nclogin.submit?LOGIN
Although, it also is not showing HSTS on the middle hop.
I'm still continuing to dig into this, but thought I would get the ticket opened while I work (since I still can't contribute directly yet).
Contributor guide
Assessment
This issue has not been assessed yet.