Skip to content

Update guide.md to clarify redirect requirements #224

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
konklone merged 2 commits into from
Jan 16, 2017
Merged

Update guide.md to clarify redirect requirements #224

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c4a1a3e
Update guide.md
h-m-f-t Jan 16, 2017
2b896ec
some rewording, and adds ToC link
konklone Jan 16, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion pages/guide.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ This page provides implementation guidance for agencies by the White House Offic
* [Do I need to shut off port 80?](#do-i-need-to-shut-off-port-80%3f)
* [What does "all Federal agency domains or subdomains" include?](#what-does-"all-federal-agency-domains-or-subdomains"-include%3f)
* [What about domains that are only used to redirect visitors to other websites?](#what-about-domains-that-are-only-used-to-redirect-visitors-to-other-websites%3f)
* [Do domains that redirect to other external domains need to redirect internally to HTTPS before redirecting externally?](#do-domains-that-redirect-to-other-external-domains-need-to-redirect-internally-to-https-before-redirecting-externally%3f)

@konklone konklone Jan 16, 2017

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Each FAQ answer also gets a link in the ToC at the top of the page for easy navigation.

* [What about domains that are technically public, but in practice are only used internally?](#what-about-domains-that-are-technically-public,-but-in-practice-are-only-used-internally%3f)
* [What happens to visitors using browsers that don’t support HSTS, like older versions of Internet Explorer?](#what-happens-to-visitors-using-browsers-that-don't-support-hsts,-like-older-versions-of-internet-explorer%3f)
* [This site redirects users to HTTPS -- why is Pulse saying it doesn't enforce HTTPS?](#this-site-redirects-users-to-https----why-is-pulse-saying-it-doesn't-enforce-https%3f)
Expand Down Expand Up @@ -106,7 +107,17 @@ Federally operated domains do not all end in `.gov`, `.mil`, or `.fed.us`. Some

### What about domains that are only used to redirect visitors to other websites?

These domains must follow all the same requirements and guidelines as domains used to host websites and APIs, including HSTS and preloading.
These domains must enable port 443 and use properly configured HTTPS.

@konklone konklone Jan 16, 2017

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What "enforce HTTPS" means for redirect domains is ambiguous here, and is what the subsequent answer now addresses, so I changed it to "properly configured".


They must follow all the same requirements and guidelines as domains used to host websites and APIs, including HSTS and preloading.

### Do domains that redirect to other external domains need to redirect internally to HTTPS before redirecting externally?

Not generally, but it is practically required in order to preload a second-level domain.

For example, it is not required by M-15-13 to redirect from `http://example.gov:80` to `https://example.gov:443` before redirecting to `https://another-example.gov:443`. However, doing so enables the connecting client to see and cache the HSTS header on `example.gov`, which it may not otherwise see.

However, doing an internal redirect first **is required** [to automatically preload second-level domains](https://hstspreload.org/#submission-requirements), and so this practice is recommended for second-level domains.

@konklone konklone Jan 16, 2017

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is technically possible to preload non-second-level-domains (and I've done so before) but it requires manual interaction with the Chrome HSTS preload team. I adjusted it to be a little more precise about that.


### What about domains that are technically public, but in practice are only used internally?

Expand Down