1638031 - HSTS headers are duplicated (3 times!)

Status: RESOLVED FIXED

(Cloud Services :: Operations: Firefox Profiler, task)

Description

[Julien Wajsberg [:julienw]]

We have 3 HSTS headers. Our service generates one, looks like some reverse proxies add their own without replacing the other. Also our header is stricter, so ideally we should keep that one instead of replacing it.

$ curl -i https://dev.firefoxprofiler.nonprod.cloudops.mozgcp.net/__version__
...
strict-transport-security: max-age=63072000; includeSubDomains
strict-transport-security: max-age=31536000
strict-transport-security: max-age=31536000
...

$ curl -i https://api.profiler.firefox.com/__version__
...
strict-transport-security: max-age=63072000; includeSubDomains
strict-transport-security: max-age=31536000
strict-transport-security: max-age=31536000
...

Comment 1

[edunham]

Checked on some other apps and they do it too. Looks like it'll be a fix in the skeleton; whoever from cloudops ends up working on this should see https://mozilla.slack.com/archives/C8WPJ66KC/p1589898680151200 where I asked about it before and Brian made some suggestions.

Comment 2

[Julien Wajsberg [:julienw]]

Thanks, I double checked and this looks good now!