Strict-Transport-Security question.
In <Ben Nadel'...
# cfml-generald
Dave Merrill
08/04/2022, 6:02 PMStrict-Transport-Security question.
In Ben Nadel's article about it in CF 2021, he only has it enabled in production, not dev, and I'm wondering why.
What's the downside of having it on in dev?
b
bdw429s
08/04/2022, 6:04 PM@Dave Merrill There really isn't one so long as you plan to always have HTTPS configured on dev
bdw429s
08/04/2022, 6:08 PMHSTS basically tells the browser to remember to always remember to hit the site over HTTPS regardless of whether you specified that in the URL
d
Dave Merrill
08/04/2022, 6:14 PMThat's what I thought, thanks.
Related, I'm adding that header, and I see it in the browser console, but I can hit the site as http (not https), and it renders the same, far as I can tell. Isn't the browser supposed to refuse in that case?
Dave Merrill
08/04/2022, 6:20 PMSame behavior in current Firefox, Chrome, and Edge.
Either I don't understand this mechanism (likely), or this isn't really implemented in the real world, but caniuse thinks it is.
What am I missing?
b
bdw429s
08/04/2022, 6:47 PMHmm, it's been a while since I've played with that,. but if you explicitly type
http://<http://site.com|site.com>bdw429s
08/04/2022, 6:48 PMThe last time I was playing with this, it was in CommandBox where I have
• a flag to enable the HSTS headers automatically
• a flag to auto-redirect all HTTP traffic to HTTPS
bdw429s
08/04/2022, 6:49 PMWhich is really nice because then you're not screwing around with cujstom HTTP headers in your CF code AND it applies to everything including static assets, which your CF headers won't affect!
d
Dave Merrill
08/04/2022, 7:05 PMI can't get any different behavior typing just the url with no protocol in a new window.
I was thinking of doing this in IIS (what the site uses), but as Ben points out, then it needs to be configured on every new server. If it's in the code, it comes with.
(Of course if it's in code, there's the problem of applying it to every page in every directory. That says application,cfc, but there are 65 of them in one app, and 104 in another, and I'd need to do the research to make sure they all extend some root cfc. Ah the joys of long-lived apps...)
f
foundeo
08/08/2022, 2:08 PM
For this kind of header, it must (according to spec) be set on all responses from the domain over https, so it is better to do it at the web server level instead of with cfheader, then it would only apply to your cfml handled requests