1335626 - Add upgrade-insecure-requests to CSP

Status: RESOLVED FIXED

(Developer Services :: Mercurial: hg.mozilla.org, defect)

Description

[Gregory Szorc [:gps]]

Ehsan suggested via email that we add upgrade-insecure-requests to the Content-Security-Policy header so requests to http:// URLs are automagically converted to https://. Sounds like a good idea!

Comment 1

[(no longer active)]

One reason that I meant to mention in the thread is that there's tons of existing HTTP links to hg.mozilla.org in Bugzilla and elsewhere and without this browsers would hit a redirect every time they click on a link since they'll all be pretty much unique.

Comment 2

[April King [:April]]

Sure, that's a fine idea.  I will say that HSTS generally already does that -- if you had visited hg.mozilla.org over HTTPS and received the HSTS header, even if the link was http://hg.mozilla.org/foo/bar, it will still go directly to https://hg.mozilla.org/foo/bar.  upgrade-insecure-requests is still a fine idea and worth pursuing, but it's more generally useful for loading resources or linking to domains that you don't have control over or can't enable HSTS on.

Comment 3

[Gregory Szorc [:gps]]

Attachment: ansible/hg-web: add "upgrade-insecure-requests" to CSP policy (bug 1335626);

This will force all http:// requests to https://, even if they are
on other domains.

Review commit: https://reviewboard.mozilla.org/r/108744/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/108744/

Comment 4

[April King [:April]]

r+, but I would recommend moving upgrade-insecure-requests to the end, as alphabetical order makes things a bit easier to read.  :)

Comment 5

[April King [:April]]

Comment on attachment 8832479 [details]
ansible/hg-web: add "upgrade-insecure-requests" to CSP policy (bug 1335626);

https://reviewboard.mozilla.org/r/108742/#review111060

Looks good, but I would probably put upgrade-insecure-requests at the end for legibility.

Comment 6

[April King [:April]]

Comment on attachment 8832479 [details]
ansible/hg-web: add "upgrade-insecure-requests" to CSP policy (bug 1335626);

https://reviewboard.mozilla.org/r/108744/#review111630

Not sure why this didn't get submitted.  Looks good, the only change I would say is to put upgrade-insecure-requests last, because it's easier to read in alphabetical order.

Comment 7

[Gregory Szorc [:gps]]

Comment on attachment 8832479 [details]
ansible/hg-web: add "upgrade-insecure-requests" to CSP policy (bug 1335626);

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/108744/diff/1-2/

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/hgcustom/version-control-tools/rev/22c90c1965dc
ansible/hg-web: add "upgrade-insecure-requests" to CSP policy ; r=April

Comment 9

[Gregory Szorc [:gps]]

I rebased this and landed it. Deploying now.