nushell / nushell/nushell.github.io
Preload HSTS for `nushell.sh`
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 258
- Forks
- 561
- Avg merge
- 3h 20m
- Merged PRs (30d)
- 15
Description
https://hstspreload.org/ is using HTTPS, but is not using the full protection of HSTS preloading:
- https://scotthelme.co.uk/hsts-the-missing-link-in-tls/?ref=scotthelme.co.uk
- https://scotthelme.co.uk/hsts-preloading/
If the subdomains are not used for any private infrastructure I would recommend using the following header:
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
The site seems to be hosted with GitHub Pages. If you'd like to set this header there's no UI for it in GitHub (yet), but I believe @yoannchaudet should be able to enable it.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the GitHub Pages hosting configuration for nushell.sh and review the requirements at hstspreload.org and the linked HSTS references. Confirm whether the subdomains are used for private infrastructure, then determine how to enable the requested Strict-Transport-Security header; done means the site is eligible for HSTS preloading.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100