You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Update guide.md to clarify redirect requirements (GSA#224)
* Update guide.md
Make explicit the expectations for redirect domains and explain that redirect domains need not (but might want to) redirect internally to the https:// version first.
* some rewording, and adds ToC link
Copy file name to clipboardExpand all lines: pages/guide.md
+12-1Lines changed: 12 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,6 +18,7 @@ This page provides implementation guidance for agencies by the White House Offic
18
18
*[Do I need to shut off port 80?](#do-i-need-to-shut-off-port-80%3f)
19
19
*[What does "all Federal agency domains or subdomains" include?](#what-does-"all-federal-agency-domains-or-subdomains"-include%3f)
20
20
*[What about domains that are only used to redirect visitors to other websites?](#what-about-domains-that-are-only-used-to-redirect-visitors-to-other-websites%3f)
21
+
*[Do domains that redirect to other external domains need to redirect internally to HTTPS before redirecting externally?](#do-domains-that-redirect-to-other-external-domains-need-to-redirect-internally-to-https-before-redirecting-externally%3f)
21
22
*[What about domains that are technically public, but in practice are only used internally?](#what-about-domains-that-are-technically-public,-but-in-practice-are-only-used-internally%3f)
22
23
*[What happens to visitors using browsers that don’t support HSTS, like older versions of Internet Explorer?](#what-happens-to-visitors-using-browsers-that-don't-support-hsts,-like-older-versions-of-internet-explorer%3f)
23
24
*[This site redirects users to HTTPS -- why is Pulse saying it doesn't enforce HTTPS?](#this-site-redirects-users-to-https----why-is-pulse-saying-it-doesn't-enforce-https%3f)
@@ -106,7 +107,17 @@ Federally operated domains do not all end in `.gov`, `.mil`, or `.fed.us`. Some
106
107
107
108
### What about domains that are only used to redirect visitors to other websites?
108
109
109
-
These domains must follow all the same requirements and guidelines as domains used to host websites and APIs, including HSTS and preloading.
110
+
These domains must enable port 443 and use properly configured HTTPS.
111
+
112
+
They must follow all the same requirements and guidelines as domains used to host websites and APIs, including HSTS and preloading.
113
+
114
+
### Do domains that redirect to other external domains need to redirect internally to HTTPS before redirecting externally?
115
+
116
+
Not generally, but it is practically required in order to preload a second-level domain.
117
+
118
+
For example, it is not required by M-15-13 to redirect from `http://example.gov:80` to `https://example.gov:443` before redirecting to `https://another-example.gov:443`. However, doing so enables the connecting client to see and cache the HSTS header on `example.gov`, which it may not otherwise see.
119
+
120
+
However, doing an internal redirect first **is required**[to automatically preload second-level domains](https://hstspreload.org/#submission-requirements), and so this practice is recommended for second-level domains.
110
121
111
122
### What about domains that are technically public, but in practice are only used internally?
0 commit comments