1077394 - Put all code hosting sites behind TLS and HSTS

Status: RESOLVED WORKSFORME

(Developer Services :: General, task)

Description

[Anne (:annevk)]

We should not distribute code in the clear. That seems irresponsible at this point.

  http://gitmirror.mozilla.org/
  http://git.mozilla.org/
  http://mxr.mozilla.org/
  http://lxr.mozilla.org/

should all redirect to their HTTPS equivalent which should have a HSTS header.

Comment 1

[Gregory Szorc [:gps]]

Agreed.

We'll need to audit the plain old HTTP accesses for automated agents that may not follow redirects properly.

Comment 2

[Ed Morley [:emorley]]

To add to the list in comment 0:
http://hg.mozilla.org/

Comment 3

[Ed Morley [:emorley]]

All of the repos in comment 0 are now decommissioned.

And hg.m.o from comment 2 now redirects and uses HSTS:

$ curl -IL http://hg.mozilla.org/
HTTP/1.1 301 Moved Permanently
...

HTTP/1.1 200 Script output follows
Strict-Transport-Security: max-age=31536000
...