675780 - Enable HSTS for intlstore.mozilla.org

Status: RESOLVED FIXED

(Websites :: intlstore.mozilla.org, defect)

Description

[Michael Coates [:mcoates] (acct no longer active)]

Issue

The intlstore is not using HSTS which would help ensure users can only access the site of HTTPS.

Recommended Solution
Add the necessary HTTP header to enforce HSTS.  More information is available at the following link

https://developer.mozilla.org/en/Security/HTTP_Strict_Transport_Security

Comment 1

[u242531]

Hi Michael,

Guest users to the store are not required to be using HTTPS on the store except for checkout/account creation pages.

Is it ok that I use the HSTS headers for logged in users, or checkout (normally https) pages only?

Running an entire store on HTTPS has had performance implications in the past, specifically when numbers get high around release times etc.

Cheers
Andrew

Comment 2

[Michael Coates [:mcoates] (acct no longer active)]

Once a user gets the HSTS header they will only send HTTPS traffic for that entire domain. So logged in users will receive the HSTS header and will always use HTTPS from that point forward, logged in or not.

HSTS would be really nice since it ensures the logged in users never "fall out" of HTTPS due to a bad HTTP link in the site. (For example, I believe removing an item from your cart will cause this right now)

Comment 3

[Adam Muntner [:adamm] (use NEEDINFO)]

intlstore is decommissioned