822771 - HSTS preload list script needs to set timeouts for its XHRs

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Dana Keeler (she/her) [:keeler]]

security/manager/tools/getHSTSPreloadList.js makes a request to each site on Chrome's HSTS preload list. At least one of these sites takes about forever to respond, which means the script hangs and we get no useful output. Adding a timeout to the requests it makes is a reasonable solution. The one thing we have to be careful about is removing sites from the list due to transient outages, but that's always been the case, so this really changes nothing.

Comment 1

[Dana Keeler (she/her) [:keeler]]

Attachment: patch

Brian - I don't know how busy you are, but I imagine this will take all of 15 seconds to review (unless this has some consequences I'm not aware of).

Comment 2

[Dana Keeler (she/her) [:keeler]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5c248ef0fe62

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/5c248ef0fe62