0000389: Check HSTS headers.

ID	Project	Category	View Status	Date Submitted	Last Update

0000389	apt-panopticon	Feature	public	2021-12-15 03:18	2021-12-15 03:33

Reporter	onefang	Assigned To	onefang
Priority	normal	Severity	minor	Reproducibility	have not tried
Status	assigned	Resolution	open
Product Version	0.1

Summary	0000389: Check HSTS headers.
Description	[09:17:08] <bb\|hcb> In the mean time I have noticed that devuan.packet-gain.de (it is in the RR) forces HSTS and that makes it unusable from firefox [09:20:01] <rrq> mmm hsts isn't expected for deb.devuan.org hosts [09:33:37] <bb\|hcb> onefang: do you check for HSTS header in apt-panopticon? [13:04:55] <onefang> No I don't check HSTS headers in apt-panopticon. I'll add a TODO. Has anyone checked if that screws with apt itself?
Additional Information	Sledhjchisl uses HSTS.
Tags	No tags attached.

onefang 2021-12-15 03:33 administrator ~0000529	[13:22:37] <bb\|hcb> HSTS is good for its purpose, but may create a problem in modern browsers... I believe that apt ignores that but this may (will most probably) change [13:23:09] <bb\|hcb> problem for http only sites like deb. [13:26:07] <onefang> Yes, that's why apt-panopticon marks "server changed HTTP to HTTPS" for deb.devuan.org mirrors as a FAIL. [13:26:38] <onefang> So HSTS should get the same result. [13:26:54] <bb\|hcb> if it does a redirect, yes; but hsts makes the client do the redirect itself and once received is quite sticky [13:27:14] <bb\|hcb> so both are bad for rr mirrors

Date Modified	Username	Field	Change
2021-12-15 03:18	onefang	New Issue
2021-12-15 03:18	onefang	Status	new => assigned
2021-12-15 03:18	onefang	Assigned To	=> onefang
2021-12-15 03:33	onefang	Note Added: 0000529