1313596 - Increase HSTS priming cache timeout

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P3)

Description

[Kate McKinley [:kmckinley, :Kate]]

HSTS priming caches the result of failed priming requests for 24 hours. Increasing this to 7 days will reduce the occurrence of HSTS Priming requests that timeout. This will reduce the number of times users experience long delays with mis-configured sites.

Comment 1

[Kate McKinley [:kmckinley, :Kate]]

Attachment: Bug 1313596 Increase HSTS Priming default cache timeout

Review commit: https://reviewboard.mozilla.org/r/89752/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/89752/

Comment 2

[Kate McKinley [:kmckinley, :Kate]]

Using a hardcoded value, but maybe this should be a pref?

Comment 3

[Christoph Kerschbaumer [:ckerschb}]

Comment on attachment 8806248 [details]
Bug 1313596 Increase HSTS Priming default cache timeout

I don't have a strong opinion. For me using a hardcoded value in this case seems reasonable. I also don't think I should be reviewing those bits. Honza is definitely the right person to ask here.

Comment 4

[Honza Bambas (:mayhemer)]

Comment on attachment 8806248 [details]
Bug 1313596 Increase HSTS Priming default cache timeout

https://reviewboard.mozilla.org/r/89752/#review89704

::: netwerk/protocol/http/nsHttpChannel.cpp:8004
(Diff revision 1)
>      }
>  
> -    // Don't visit again for at least one day
> +    // Don't visit again for at least HSTS_PRIMING_CACHE_TIMEOUT seconds
>      nsISiteSecurityService* sss = gHttpHandler->GetSSService();
>      NS_ENSURE_TRUE(sss, NS_ERROR_OUT_OF_MEMORY);
> -    nsresult rv = sss->CacheNegativeHSTSResult(mURI, 24 * 60 * 60);
> +    nsresult rv = sss->CacheNegativeHSTSResult(mURI, HSTS_PRIMING_CACHE_TIMEOUT);

please make a preference for this.

see https://dxr.mozilla.org/mozilla-central/source/modules/libpref/Preferences.h for some nice and easy to use APIs (AddUintVarCache)

add your preference to https://dxr.mozilla.org/mozilla-central/source/modules/libpref/init/all.js

I am not sure if this is a gecko (or even necko) feature or it's a browser feature.  up to you to decide on the preference prefix (either browser. or network. or something else)

Comment 5

[Kate McKinley [:kmckinley, :Kate]]

Comment on attachment 8806248 [details]
Bug 1313596 Increase HSTS Priming default cache timeout

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/89752/diff/1-2/

Comment 6

[Honza Bambas (:mayhemer)]

Comment on attachment 8806248 [details]
Bug 1313596 Increase HSTS Priming default cache timeout

https://reviewboard.mozilla.org/r/89752/#review91604

::: dom/security/nsMixedContentBlocker.h:101
(Diff revision 2)
>    static bool sBlockMixedDisplay;
> +  // Do we move HSTS before mixed-content
>    static bool sUseHSTS;
> +  // Do we send an HSTS priming request
>    static bool sSendHSTSPriming;
> +  // Default HSTS Priming failure timeout

// Default HSTS Priming cached failure timeout in seconds

::: dom/security/test/hsts/browser_hsts-priming_cache-timeout.js:1
(Diff revision 2)
> +

nit: remove the top blank line

Comment 7

[Kate McKinley [:kmckinley, :Kate]]

Comment on attachment 8806248 [details]
Bug 1313596 Increase HSTS Priming default cache timeout

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/89752/diff/2-3/

Comment 8

[Kate McKinley [:kmckinley, :Kate]]

Comment on attachment 8806248 [details]
Bug 1313596 Increase HSTS Priming default cache timeout

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/89752/diff/3-4/

Comment 9

[Kate McKinley [:kmckinley, :Kate]]

Comment on attachment 8806248 [details]
Bug 1313596 Increase HSTS Priming default cache timeout

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/89752/diff/4-5/

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/91d0760b71d4
Increase HSTS Priming default cache timeout r=mayhemer

Comment 11

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3e38456aa52a
Backed out changeset 91d0760b71d4 on developers request

Comment 12

[Kate McKinley [:kmckinley, :Kate]]

Attachment: Increase HSTS Priming default cache timeout - fixup patch

Fixup pref name.
Fixup failing no-duplicates test

https://treeherder.mozilla.org/#/jobs?repo=try&revision=3f445f3cff2375335811c8b3a66ba2099b085425

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/817c3befbadc
Increase HSTS Priming default cache timeout. r=mayhemer

Comment 14

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/817c3befbadc