Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't require internal redirects before redirecting to HTTPS #87

Open
konklone opened this issue Aug 22, 2016 · 5 comments
Open

Don't require internal redirects before redirecting to HTTPS #87

konklone opened this issue Aug 22, 2016 · 5 comments

Comments

@konklone
Copy link
Collaborator

konklone commented Aug 22, 2016

The HSTS preload checker currently requires an internal redirect before an external redirect:

screenshot from 2016-08-22 16-05-16

In this case, the domain in question (greengov.gov) always redirects immediately to https://www.whitehouse.gov/greengov/, whether it's accessed over HTTP or HTTPS, or at www or the base of the domain.

There is an obvious performance hit, and there are no security benefits I can think of to requiring the domain to internally redirect before externally redirecting, other than causing the client to cache the HSTS policy on the way through the double-redirect. However, since this scan is for the purpose of preloading the domain, this isn't really relevant -- once the domain is preloaded, there will be no security benefit to forcing clients to go through that redirect.

I think it should be sufficient that a domain's HTTP endpoints redirect immediately and consistently to HTTPS throughout the redirect chain this tool measures, whether or not these redirect locations are internal to the requested hostname or not. This would allow "redirect domains" like greengov.gov to maintain their performance properties while achieving the same level of functional security as other domains.

@lgarron
Copy link
Collaborator

lgarron commented Aug 22, 2016

I'm happy to remove this requirement as soon as we have a solution in place for https://crbug.com/626180

@konklone
Copy link
Collaborator Author

@lgarron Got it -- I commented on the bug: https://bugs.chromium.org/p/chromium/issues/detail?id=626180#c7

@konklone
Copy link
Collaborator Author

Not sure who's triaging these issues, though cc @ericlaw1979 in case he's interested. This remains a requirement that is causing some domains to not maintain preload eligibility as external redirects are setup.

For example, dotgov.gov is now no longer eligible, because http://dotgov.gov now redirects to https://home.dotgov.gov directly. While it's certainly not impossible to configure an intermediate redirect, see my comments above for the performance/complexity hit for a security gain that shouldn't be that significant once preloading is completed.

@ericlaw1979
Copy link
Collaborator

+@nharper. I'm not opposed to removing the current same-host redirection requirement.

@lgarron
Copy link
Collaborator

lgarron commented Mar 20, 2018

I'm still opposed to it until we fix https://crbug.com/626180 , especially given that Safari is now moving farther away from supporting cross-domain HSTS without direct navigation. :-/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants