1310813 - Enable HSTS with preloading on people-mozilla.org

Status: RESOLVED FIXED

(Infrastructure & Operations :: Infrastructure: Other, task)

Description

[:Atoll]

people-mozilla.org should only serve traffic over HTTPS, entirely deprecating support for HTTP content-serving as is currently supported at http://people.mozilla.org.

Please set the HTTPS virtualhost for people-mozilla.org (*not* people.mozilla.org, people.mozilla.com, or http:// anything) to include the following line:

  Header always set Strict-Transport-Security "max-age=31536000; includeSubdomains; preload"


Once that header is live and being served at https://people-mozilla.org/, please submit the site to the HSTS Preload list, which will ensure that it's compiled into all modern browsers as HTTPS-only:

  https://hstspreload.appspot.com/


This will have a material effect on your HTTP Observatory score on the riskheatmap dashboard.

Comment 1

[Brian Hourigan [:digi]]

This was shipped on 10/31 during the people-mozilla.org redirect maintenance. I refreshed the score on the HTTP Observatory and it's now a D+.

Comment 2

[:Atoll]

Reopening for the second part of the request - please go to:

https://hstspreload.appspot.com/?domain=people-mozilla.org

And complete that set of steps. This will force browsers to HTTPS to all URLs at that domain regardless of what the user types.

Comment 3

[:Atoll]

Also, I filed https://github.com/mozilla/http-observatory/issues/159 to have observatory warn us of miscapitalized HSTS header attribute names, because that's an easy thing to catch.

Comment 4

[Brian Hourigan [:digi]]

(In reply to Richard Soderberg [:atoll] from comment #2)
> Reopening for the second part of the request - please go to:
> 
> https://hstspreload.appspot.com/?domain=people-mozilla.org
> 
> And complete that set of steps. This will force browsers to HTTPS to all
> URLs at that domain regardless of what the user types.

Thanks for that, I went ahead and fixed the case issue in 1b6702d26c60042f1e171d729a845a3a21f14cea. I verified it showed as fixed and completed the steps.

(In reply to Richard Soderberg [:atoll] from comment #3)
> Also, I filed https://github.com/mozilla/http-observatory/issues/159 to have
> observatory warn us of miscapitalized HSTS header attribute names, because
> that's an easy thing to catch.

Great!

Comment 5

[:Atoll]

All good here, then :)