Update guide.md to clarify redirect requirements - #224
Merged
Merged
Conversation
Make explicit the expectations for redirect domains and explain that redirect domains need not (but might want to) redirect internally to the https:// version first.
konklone
approved these changes
Jan 16, 2017
| ### What about domains that are only used to redirect visitors to other websites? | ||
|
|
||
| These domains must enable port 443, use and enforce HTTPS, and follow all the same requirements and guidelines as domains used to host websites and APIs, including HSTS and preloading. | ||
| These domains must enable port 443 and use properly configured HTTPS. |
Contributor
There was a problem hiding this comment.
What "enforce HTTPS" means for redirect domains is ambiguous here, and is what the subsequent answer now addresses, so I changed it to "properly configured".
|
|
||
| For example, it is not required by M-15-13 to redirect from `http://example.gov:80` to `https://example.gov:443` before redirecting to `https://another-example.gov:443`. However, doing so enables the connecting client to see and cache the HSTS header on `example.gov`, which it may not otherwise see. | ||
|
|
||
| However, doing an internal redirect first **is required** [to automatically preload second-level domains](https://hstspreload.org/#submission-requirements), and so this practice is recommended for second-level domains. |
Contributor
There was a problem hiding this comment.
It is technically possible to preload non-second-level-domains (and I've done so before) but it requires manual interaction with the Chrome HSTS preload team. I adjusted it to be a little more precise about that.
| * [Do I need to shut off port 80?](#do-i-need-to-shut-off-port-80%3f) | ||
| * [What does "all Federal agency domains or subdomains" include?](#what-does-"all-federal-agency-domains-or-subdomains"-include%3f) | ||
| * [What about domains that are only used to redirect visitors to other websites?](#what-about-domains-that-are-only-used-to-redirect-visitors-to-other-websites%3f) | ||
| * [Do domains that redirect to other external domains need to redirect internally to HTTPS before redirecting externally?](#do-domains-that-redirect-to-other-external-domains-need-to-redirect-internally-to-https-before-redirecting-externally%3f) |
Contributor
There was a problem hiding this comment.
Each FAQ answer also gets a link in the ToC at the top of the page for easy navigation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Several federal agencies have requested additional clarity around the requirements for redirect domains. This change is an attempt to make explicit that redirect domains that are currently only serving port 80 must also serve 443 and generally comply with M-15-13.
The change also explains that redirect domains need not (but might want to, especially w/r/t preloading) redirect internally to the https:// version first.