keybase / keybase/keybase-issues

Failed HTTP proof after enabling HSTS

Open
#662 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

Hi! I recently improved my website's setup, and among others moved to a HTTPS only setup by setting the HSTS header. This means that my website is no longer reachable via http, and in fact the http version automatically redirects to https. I did a new identity proof for `web`, proving ownership of the HTTPS version. Until here, everything is fine.

Now when I want to verify my http identity proof, the keybase client receives an `HTTP 301 Moved Permanently` redirect and the proof fails:

```
$ keybase id lorenz
✔ public key fingerprint: 7871 0F91 B81A D783 A314 6481 2452 F4DF D3FC 902C
✔ "znetroll" on twitter: https://twitter.com/znetroll/status/454232484935634944
✔ "lorenzhs" on github: https://gist.github.com/10373791
✖ admin of 4z2.de via HTTP: http://4z2.de/keybase.txt (failed with code 201)
✔ admin of 4z2.de via HTTPS: https://4z2.de/keybase.txt
✔ admin of the DNS zone for 4z2.de
```

I'm not sure what the correct behaviour would be here, but this doesn't seem correct.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the failure with `keybase id lorenz` against `http://4z2.de/keybase.txt`, then trace the client’s HTTP identity-proof verification path. The issue does not identify files or tests, so first determine the expected behavior for an HTTP 301 redirect to HTTPS. Done means the redirect behavior is resolved and covered by a regression test.

Written by the indexing model from the issue text.

Assessment

Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.