671992 - Enable Strict Transport Security to Enhance Connection Security

Status: VERIFIED FIXED

(Mozilla Labs :: Identity, defect)

Description

[Michael Coates [:mcoates] (acct no longer active)]

Issue

The browserid.org website is not leveraging the additional security benefits provided by HTTP Strict Transport Security.  This feature can be easily added and will ensure that browsers that support HSTS can not be fooled into establishing an insecure communication (such as from a man in the middle attack) with https://browserid.org/

Recommended Remediation

Implement STS for the domain browserid.org and also include the subdomain flag.  This can be achieved by adding the response header "Strict-Transport-Security" for all responses.

Note: this will apply to all HTTP interaction with this domain and subdomains. Please ensure this will work correctly if any other pages are located at this domain but not associated with account portal.


Additional information
https://developer.mozilla.org/en/Security/HTTP_Strict_Transport_Security

Comment 1

[Ben Adida [:benadida]]

this is now committed in the dev branch, should be deployed in dev next Thursday.

Comment 2

[Ben Adida [:benadida]]

this is now fixed in production.

Comment 3

[Yvan Boily [:ygjb][:yvan]]

Opening since this is no longer an issue.