Skip to content

Clarifying non-content servers and use of 4xx/5xx codes #230

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
justgrimes merged 4 commits into from
May 16, 2017
Merged

Clarifying non-content servers and use of 4xx/5xx codes #230

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b8a2069
Added two FAQ entries to the guide to clarify the applicability of M-…
egyptiankarim Apr 10, 2017
9d44085
rework text of the PR to integrate a bit better
konklone Apr 11, 2017
d90d414
update TOC to reflect changes
konklone Apr 11, 2017
3fbfc01
fix anchor link
konklone Apr 11, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion pages/guide.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ This page provides implementation guidance for agencies by the White House Offic
* [Compliance FAQ](#compliance-faq)
* [What protocols are covered by M-15-13?](#what-protocols-are-covered-by-m-15-13%3f)
* [Do I need to shut off port 80?](#do-i-need-to-shut-off-port-80%3f)
* [What about network services that don't actually serve web content?](#what-about-network-services-that-don't-actually-serve-web-content%3f)
* [What does "all Federal agency domains or subdomains" include?](#what-does-"all-federal-agency-domains-or-subdomains"-include%3f)
* [What about domains that are only used to redirect visitors to other websites?](#what-about-domains-that-are-only-used-to-redirect-visitors-to-other-websites%3f)
* [Do domains that redirect to other external domains need to redirect internally to HTTPS before redirecting externally?](#do-domains-that-redirect-to-other-external-domains-need-to-redirect-internally-to-https-before-redirecting-externally%3f)
Expand All @@ -25,7 +26,6 @@ This page provides implementation guidance for agencies by the White House Offic
* [Are federally operated certificate revocation services (CRL, OCSP) also required to move to HTTPS?](#are-federally-operated-certificate-revocation-services-(crl,-ocsp)-also-required-to-move-to-https%3f)
* [What if I'm using a federally issued certificate -- such as from the Federal PKI or Department of Defense -- for my web service?](#what-if-i'm-using-a-federally-issued-certificate----such-as-from-the-federal-pki-or-department-of-defense----for-my-web-service%3f)


## Compliance and best practice checklist

Each public website or web service an agency operates **must**:
Expand Down Expand Up @@ -91,10 +91,22 @@ M-15-13 does not address the use of DNS or DNSSEC, FTP or SFTP, or any other non

Agencies may employ port 80 for the sole purpose of redirecting clients to a secure connection.

HTTP redirects must use a response code in the 300's that can reliably cause HTTP clients to perform redirects to an HTTPS URI, such as 301 or 302.

The use of error codes in the 400's or 500's **will not** satisfy this requirement.

Note that while connections to port 80 are insecure, even for redirects, the use of [HSTS](/hsts/]) will instruct supporting HTTP clients to automatically redirect themselves from port 80 to port 443, without attempting to connect to port 80 over the network.

HSTS mitigates the security impact of connections over port 80, while allowing agencies the flexibility to continue redirecting legacy clients or clients which have not yet received an HSTS policy for the target domain.

### What about network services that don't actually serve web content?

M-15-13 covers any publicly accessible network service that responds to HTTP requests. This includes network services that don't serve content, but only return HTTP headers, or blank or insubstantial content.

This also includes services that respond to HTTP requests on non-standard ports (ports other than 80 or 443), whether or not those services are included in external scans provided to agencies.

Network services which do not respond to HTTP requests are not included in the scope of M-15-13.

### What does "all Federal agency domains or subdomains" include?

Domains and subdomains, in the context of M-15-13, refer to hostnames that are publicly accessible via HTTP or HTTPS.
Expand Down