1312135 - Enable HSTS on hg.mozilla.org

Status: RESOLVED FIXED

(Developer Services :: Mercurial: hg.mozilla.org, defect)

Description

[Gregory Szorc [:gps]]

Enabling HSTS on hg.mozilla.org seems like an obvious incremental security win before we shut off plain text completely in bug 450645. And atoll seems to agree in other channels :)

The concerns about clients still using hg.mozilla.org:80 in bug 450645 relate to automated, non-browser clients. So, I can't imagine enabling HSTS (which will likely only impact browsers) will cause any significant breakage *knock on wood*.

atoll: is enabling HSTS something you prefer to do on the load balancers? Or would you like the origin servers emitting the header?

The only (minor) issue I see is response overhead on Mercurial protocol responses, which won't benefit from the header. We could filter those out by looking for "cmd?" in the URL or "mercurial/proto" in the User-Agent request header. But if people think it is better to make it a blanket setting, I totally understand.

Comment 1

[:Atoll]

I think Zeus is better equipped to conditionally set the header, and the origin servers are better equipped to always set the header. Either would be perfectly fine here, I'm available to help :fubar or anyone implement the conditional TS in stage if needed.

Comment 2

[Gregory Szorc [:gps]]

Attachment: hgserver: enable HTTP Strict Transport Security (HSTS) (bug 1312135);

We exclude Mercurial protocol requests and requests from Mercurial
user agents because the HSTS header won't do anything for these
clients.

By implementing this on the origin servers instead of the load balancer,
we're able to write tests that HSTS is working as advertised.

Review commit: https://reviewboard.mozilla.org/r/88154/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/88154/

Comment 3

[:Atoll]

Comment on attachment 8803966 [details]
hgserver: enable HTTP Strict Transport Security (HSTS) (bug 1312135);

Looks good, assuming it works. We commonly see 5 minutes, 1 day, 1 year as the step-up intervals for HSTS - you start at 1 hour here, which is fine too.

Comment 4

[Gregory Szorc [:gps]]

Comment on attachment 8803966 [details]
hgserver: enable HTTP Strict Transport Security (HSTS) (bug 1312135);

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/88154/diff/1-2/

Comment 5

[Gregory Szorc [:gps]]

If the initial rollout is 5 minutes elsewhere, let's do that here too.

I also just announced the HSTS rollout to dev-version-control. Let's wait ~24 hours to give anyone time to raise concerns. I don't anticipate things going wrong with this service. But you never know.

Comment 6

[Kendall Libby [:fubar] (he/him)]

Comment on attachment 8803966 [details]
hgserver: enable HTTP Strict Transport Security (HSTS) (bug 1312135);

https://reviewboard.mozilla.org/r/88154/#review87102

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/hgcustom/version-control-tools/rev/573476da2cb5
hgserver: enable HTTP Strict Transport Security (HSTS) ; r=fubar

Comment 8

[Gregory Szorc [:gps]]

This is deployed to production.