840748 - Switch to HTTPS-only

Status: RESOLVED WONTFIX

(Input :: General, defect)

Description

[James Socol [:jsocol, :james]]

This may require some research.

* Are we using a CDN?
* Does IT have any objections?
* Are there any cache policies that need to change?

There are two parts to this:
1) make http redirect to https (this is on Ops).
2) add STS middleware/headers.

There are two related Firefox changes.
a) Bug 840737 - Switch in-product URLs to HTTPS. We should let this happen first.
b) (Not filed yet) get on the HSTS preload list (no Firefox will ever request HTTP again!)

Comment 1

[James Socol [:jsocol, :james]]

Derp, sorry, that's bug 840678.

Comment 2

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

In order to do b), You need to start sending the Strict-Transport-Security header. We only put sites on the preloaded list if they are sending that header with an expiration time of more than 18 weeks.

Comment 3

[James Socol [:jsocol, :james]]

(In reply to Brian Smith (:bsmith) from comment #2)
> In order to do b), You need to start sending the Strict-Transport-Security
> header. We only put sites on the preloaded list if they are sending that
> header with an expiration time of more than 18 weeks.

(In reply to James Socol [:jsocol, :james] from comment #0)
> 2) add STS middleware/headers.

Yep!

Comment 4

[Will Kahn-Greene [:willkg] ET needinfo? me]

Putting these in my queue for this quarter.

Comment 5

[Will Kahn-Greene [:willkg] ET needinfo? me]

Pretty sure we can't do this now because we have to support http://m.input.mozilla.org/ for a couple more Firefox for Android versions.

Pushing this out of my queue for now.

Comment 6

[Will Kahn-Greene [:willkg] ET needinfo? me]

I'm pretty sure we're still waiting on things. Going to bump this out of the sprints.

Comment 7

[Osmose [:osmose, :mkelly]]

The Input service has been decommissioned (see bug 1315316) and has been replaced by a redirect to an external vendor (SurveyGizmo). I'm bulk WONTFIXing Input bugs that do not appear to be relevant anymore.