675177 - Add secure http redirects for https://*.s.m.c/

Status: RESOLVED WONTFIX

(Cloud Services :: Operations: Miscellaneous, task)

Description

[:ibai]

http://account.services.mozilla.com/ Returns an error.

Can we redirect it to the https:// version?

Comment 1

[Toby Elliott [:telliott]]

Moving to ops, since this is really a nginx/zeus change

Comment 2

[:Atoll]

We are technically capable of doing so, but traditionally do not publish non-HTTP. Leaving open for future consideration.

Comment 3

[:Atoll]

Would need to enable HSTS:

http://michael-coates.blogspot.com/2011/07/enhancing-secure-communications-with.html

Comment 4

[Pete Fritchman [:petef]]

HSTS is enabled for all of our SSL sites, now. For example:

% curl -sD- https://account.services.mozilla.com | grep Strict-Transport-Security
Strict-Transport-Security: max-age=315360000

Please re-open if there are still compelling reasons (lots of user complaints, maybe?) to turn on port 80 and add a redirect.

Comment 5

[:Atoll]

Verbal discussion with :mcoates a few weeks ago confirms that we are not going to be opening port 80 as these sites are entirely :443, and have never been advertised anywhere with http://, and so after the first visit to the site by a user hand-typing URLs, they'll be sent to https:// every time thereafter.