Allow setting HSTS on a per domain basis #6953
Conversation
- Do not expose this to the public UI
| @@ -114,3 +115,20 @@ def process_request(self, request): # noqa | |||
| request.host_project_slug = request.slug = ret | |||
|
|
|||
| return None | |||
|
|
|||
| def process_response(self, request, response): # noqa | |||
| """Set the Strict-Transport-Security (HSTS) header for a custom domain if max-age>0.""" | |||
There was a problem hiding this comment.
We should add support for our own domains here too. It should be as simple as checking for request.subdomain and perhaps settings.PUBLIC_DOMAIN_USES_HTTPS and setting them to what we want.
There was a problem hiding this comment.
Just so I'm clear, you're envisioning that we should set the HSTS header in proxito (if appropriate) exclusively in middleware whether it's for a custom domain or for the public domain (*.readthedocs.io)?
You're still planning on relying on nginx setting the HSTS header for the dashboard/production domain (readthedocs.org), correct? Because we want this header set for some domains and not others, we can't rely on the usual method of Django's SecurityMiddleware.
There was a problem hiding this comment.
Yep, just for the requests through proxito on the PUBLIC_DOMAIN and probably EXTERNAL_DOMAIN (PR builders) as well.
|
Woooo! Extremely thrilled to see this, please let us know when/how we can help beta test this! Thank you so much for working on this, having this natively in RTD is going to let us (pyca) kill the remaining infrastructure we run ourselves |
|
How can we work with y'all to start trialing this for some of the PyCA domains :D |
|
@alex If you have a list of projects, we can enable them after deploy tomorrow. We can confirm its working by hitting the servers directly with curl before migrating things over. |
|
Let's start with pyOpenSSL, if that works well we can do cryptography.io
(which is a bit more work since we have to repoint DNS for that one)
…On Mon, Apr 27, 2020 at 10:49 PM Eric Holscher ***@***.***> wrote:
@alex <https://github.com/alex> If you have a list of projects, we can
enable them after deploy tomorrow. We can confirm its working by hitting
the servers directly with curl before migrating things over.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#6953 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAAAGBHNZAZK2BPWDNB2RJTROY75DANCNFSM4MOYQJTQ>
.
--
All that is necessary for evil to succeed is for good people to do nothing.
|
|
I still have a bit of refactoring and a few more features to add here but since this change requires admin flags to be set to take effect we should be able to test it. |
|
@alex I've just enabled this: |
|
Hot damn! This is fantastic, thank you!
…On Tue, Apr 28, 2020 at 3:20 PM Eric Holscher ***@***.***> wrote:
@alex <https://github.com/alex> I've just enabled this:
-> curl -sIL https://www.pyopenssl.org/en/stable/ |grep security
strict-transport-security: max-age=3600
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#6953 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAAAGBCYAYMLQOK4COMSGWTRO4UA3ANCNFSM4MOYQJTQ>
.
--
All that is necessary for evil to succeed is for good people to do nothing.
|
|
@ericholscher Would it be better to track this stuff in it's own ticket or an email thread with us? We'll want to add preload, include subdomains, and bump up the max-age gradually as the next steps. |
|
@alex either works for me. Feel free to open an RTD ticket or email me directly. 👍 |
|
If you do an RTD ticket, any of the RTD core folks could do it too. |
|
I've filed #6984, hopefully this is an ok place! |
Fixes #4135