1061137 - https://accounts.firefox.com no longer sending HSTS header

Status: RESOLVED FIXED

(Cloud Services :: Server: Firefox Accounts, defect)

Description

[Reed Loden [:reed]]

https://accounts.firefox.com no longer sends an HSTS header (Strict-Transport-Security)

$ curl -I https://accounts.firefox.com
HTTP/1.1 200 OK
Content-length: 1985
Content-Type: text/html; charset=utf-8
Date: Mon, 01 Sep 2014 09:43:12 GMT
ETag: W/"7c1-1995208239"
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Connection: keep-alive

This broke sometime within the last week, as per https://hg.mozilla.org/mozilla-central/rev/984eb24bd94f. This means Firefox is no longer including accounts.firefox.com in the HSTS preload list.

Comment 1

[Chris Karlof [:ckarlof]]

Thanks!

In our last release, we updated the module we use to set this, and I think that may have broken it. We're investigating: https://github.com/mozilla/fxa-content-server/issues/1614

Comment 2

[Shane Tomlinson [:stomlinson]]

This was fixed in https://github.com/mozilla/fxa-content-server/pull/1615

➜  curl -I https://accounts.firefox.com
HTTP/1.1 200 OK
Content-Length: 1979
Content-Type: text/html; charset=utf-8
Date: Mon, 16 Mar 2015 14:54:15 GMT
ETag: W/"7bb-2083316438"
Strict-Transport-Security: max-age=15552000; includeSubdomains
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Connection: keep-alive