1125894 - implement HSTS for RelengAPI

Status: RESOLVED FIXED

(Release Engineering :: General, defect)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

Indicate to browsers that HTTPS should *always* be used.

This is just a header, along with a redirect from http to https.

Comment 1

[Rok Garbas [:garbas]]

:dustin

HSTS headers is currently impossible to setup on via Amazon CloudFront. We use CloudFront and S3 to server static pages. No idea how to proceed there.

On heroku we host individual json apis. There we can set the headers as we want. I will look into adding it before hawaii all hands. (eg. https://github.com/kennethreitz/flask-sslify)

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

I've never configured it in either of those situations, so I don't have much info to provide.  I'll be following your work with interest and may do the same in TC :)

Comment 3

[Rok Garbas [:garbas]]

I only implemented HSTS for "new" relengapi: https://mozilla-releng

Currently deployed:
 - TryChooser
 - TreeStatus (backend: https://treestatus.mozilla-releng.net)

New services will be migrated shortly and will all "inherit" this setup automatically.


HSTS got implemented using `flask-talisman`[1] and its configuration can be found in `lib/releng_common`[2] security module:

[1] https://github.com/GoogleCloudPlatform/flask-talisman
[2] https://github.com/mozilla-releng/services/blob/3b857db27bd88ea8a49aae8cac4f3e2fb0b76c69/lib/releng_common/releng_common/security.py#L27


I will implement this later this month also in "old" relengapi: https://api.pub.build.mozilla.org/

Comment 4

[Jake Watkins [:dividehex]]

"old" releng API is gone since it died with SCL3 but mozilla-releng.net still exists under aws cloudfront. There is a way to implement HSTS with lambda as noted under this blog post:

https://aws.amazon.com/blogs/networking-and-content-delivery/adding-http-security-headers-using-lambdaedge-and-amazon-cloudfront/

Comment 5

[Rok Garbas [:garbas]]

this is now done. with the migration to GCP