keybase / keybase/keybase-issues
Failed HTTP proof after enabling HSTS
- Dominant language
- No language data
- Stars
- 899
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
Hi! I recently improved my website's setup, and among others moved to a HTTPS only setup by setting the HSTS header. This means that my website is no longer reachable via http, and in fact the http version automatically redirects to https. I did a new identity proof for `web`, proving ownership of the HTTPS version. Until here, everything is fine.
Now when I want to verify my http identity proof, the keybase client receives an `HTTP 301 Moved Permanently` redirect and the proof fails:
```
$ keybase id lorenz
✔ public key fingerprint: 7871 0F91 B81A D783 A314 6481 2452 F4DF D3FC 902C
✔ "znetroll" on twitter: https://twitter.com/znetroll/status/454232484935634944
✔ "lorenzhs" on github: https://gist.github.com/10373791
✖ admin of 4z2.de via HTTP: http://4z2.de/keybase.txt (failed with code 201)
✔ admin of 4z2.de via HTTPS: https://4z2.de/keybase.txt
✔ admin of the DNS zone for 4z2.de
```
I'm not sure what the correct behaviour would be here, but this doesn't seem correct.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the failure with `keybase id lorenz` against `http://4z2.de/keybase.txt`, then trace the client’s HTTP identity-proof verification path. The issue does not identify files or tests, so first determine the expected behavior for an HTTP 301 redirect to HTTPS. Done means the redirect behavior is resolved and covered by a regression test.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100