1049767 - Redirect HTTP to HTTPS and support HSTS?

Status: RESOLVED WONTFIX

(Cloud Services :: Operations: Deployment Requests - DEPRECATED, task)

Description

[Peter deHaan [:pdehaan]]

via https://www.expeditedssl.com/simple-ssl-scanner/scan?target_domain=call.mozilla.com

The report gives us 3/5, and suggests the following improvements:

```
## Redirects 'http' to 'https'

This is an optional requirement as your web application may or may not need to be fully SSL secured.

You'll need to implement this in your application.

---

## Site uses HSTS

HTTP Strict Transport Security (HSTS) is a HTTP response header that is set on your web application server. Supporting browsers read the header which contains an expiration max-age value and will NOT reconnect on a plain HTTP connection until the max-age value is exceeded. HSTS prevents a variety of attacks where an intermediary could disrupt or spoof connections.

More HSTS information at: http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
```

Comment 1

[Peter deHaan [:pdehaan]]

I filed these separately for Loop::Server, but let me know if you prefer that I file the two issues above separately so we can track them individually.

Or if there is an OPS repo that you'd rather I file these, that's cool too.

Comment 2

[Peter deHaan [:pdehaan]]

FYI, the same 2 issues seem to get reported for msisdn.services.mozilla.com as well. But I'm not paid by the bug, so I won't file this again for that repo unless somebody wants me to. #qaisstandingby

https://www.expeditedssl.com/simple-ssl-scanner/scan?target_domain=msisdn.services.mozilla.com

Comment 3

[Mark Banner (:standard8)]

Moving to server, as this is either a server issue or a deployment one.

Comment 4

[Alexis Metaireau (:alexis)]

Just to clarify: we are talking about the webapp, not the server.

In this case, it will be good to redirect the http calls to a secure connection.

Moving this to the deployments since this has nothing to do with how that's implemented on the server.