Bedrock: No HSTS header for locale redirect responses

[pmac]

@april reported in IRC that our Observatory score is randomly low due to sometimes missing the HSTS header. It looks to me like this is because the 301 redirect from https://www.mozilla.org/ to https://www.mozilla.org/en-US/ does not include the header.

$ curl -IL https://www.mozilla.org
HTTP/2 301
date: Thu, 02 Aug 2018 00:59:44 GMT
content-type: text/html; charset=utf-8
x-xss-protection: 1; mode=block
x-robots-tag: noodp
content-security-policy: script-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com 'unsafe-inline' 'unsafe-eval' www.googletagmanager.com www.google-analytics.com tagmanager.google.com www.youtube.com s.ytimg.com; img-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com data: mozilla.org www.googletagmanager.com www.google-analytics.com creativecommons.org ad.doubleclick.net; default-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com; frame-src www.googletagmanager.com www.google-analytics.com www.youtube-nocookie.com trackertest.org www.surveygizmo.com accounts.firefox.com accounts.firefox.com.cn www.youtube.com; style-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com 'unsafe-inline' fast.fonts.net; connect-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com www.googletagmanager.com www.google-analytics.com; child-src www.googletagmanager.com www.google-analytics.com www.youtube-nocookie.com trackertest.org www.surveygizmo.com accounts.firefox.com accounts.firefox.com.cn www.youtube.com
x-backend-server: bedrock-prod-web-6dcb956b5c-nttz2.iowa-a
expires: Thu, 02 Aug 2018 00:53:56 GMT
vary: Accept-Language
etag: "d41d8cd98f00b204e9800998ecf8427e"
location: https://www.mozilla.org/en-US/
cache-control: max-age=600
x-frame-options: DENY
x-content-type-options: nosniff
via: 1.1 google
alt-svc: clear
cf-cache-status: HIT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 443c9a837a34b9d6-ATL

HTTP/2 200
date: Thu, 02 Aug 2018 00:59:44 GMT
content-type: text/html; charset=utf-8
cache-control: max-age=600
content-security-policy: script-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com 'unsafe-inline' 'unsafe-eval' www.googletagmanager.com www.google-analytics.com tagmanager.google.com www.youtube.com s.ytimg.com; img-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com data: mozilla.org www.googletagmanager.com www.google-analytics.com creativecommons.org ad.doubleclick.net; default-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com; frame-src www.googletagmanager.com www.google-analytics.com www.youtube-nocookie.com trackertest.org www.surveygizmo.com accounts.firefox.com accounts.firefox.com.cn www.youtube.com; style-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com 'unsafe-inline' fast.fonts.net; connect-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com www.googletagmanager.com www.google-analytics.com; child-src www.googletagmanager.com www.google-analytics.com www.youtube-nocookie.com trackertest.org www.surveygizmo.com accounts.firefox.com accounts.firefox.com.cn www.youtube.com
etag: "9333e751092811efe4d73c2b9a8ee88e"
expires: Wed, 01 Aug 2018 13:51:28 GMT
strict-transport-security: max-age=31536000
x-backend-server: bedrock-prod-web-557cbd9d9d-zgb8n.bedrock-prod.oregon-b.moz.works
x-clacks-overhead: GNU Terry Pratchett
x-content-type-options: nosniff
x-frame-options: DENY
x-robots-tag: noodp
x-xss-protection: 1; mode=block
cf-cache-status: HIT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 443c9a83ba86b9d6-ATL

My guess at this point is that this is due to a Django Middleware ordering error. I'm investigating now.

[pmac]

Hmm... this is very odd. The middleware ordering looks okay. Also the x-xss-protection and x-content-type-options headers are also added by the same SecurityMiddleware from Django and are present in the 301 response. So now I'm wondering if cloudflare isn't messing with the headers for these redirects. They are different page rules there. Perhaps there's a problem.

Also I have no idea what the via: 1.1 google header is...

[jwhitlock]

My results:

n$ curl -IL https://www.mozilla.org/
HTTP/2 301 
date: Thu, 02 Aug 2018 14:02:13 GMT
content-type: text/html; charset=utf-8
content-length: 0
cache-control: max-age=600
content-security-policy: script-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com 'unsafe-inline' 'unsafe-eval' www.googletagmanager.com www.google-analytics.com tagmanager.google.com www.youtube.com s.ytimg.com; img-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com data: mozilla.org www.googletagmanager.com www.google-analytics.com creativecommons.org ad.doubleclick.net; default-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com; frame-src www.googletagmanager.com www.google-analytics.com www.youtube-nocookie.com trackertest.org www.surveygizmo.com accounts.firefox.com accounts.firefox.com.cn www.youtube.com; style-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com 'unsafe-inline' fast.fonts.net; connect-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com www.googletagmanager.com www.google-analytics.com; child-src www.googletagmanager.com www.google-analytics.com www.youtube-nocookie.com trackertest.org www.surveygizmo.com accounts.firefox.com accounts.firefox.com.cn www.youtube.com
etag: "d41d8cd98f00b204e9800998ecf8427e"
expires: Thu, 02 Aug 2018 14:04:05 GMT
location: https://www.mozilla.org/en-US/
strict-transport-security: max-age=31536000
vary: Accept-Language
x-backend-server: bedrock-prod-web-7bcb7db587-spwmf.bedrock-prod.oregon-b.moz.works
x-content-type-options: nosniff
x-frame-options: DENY
x-robots-tag: noodp
x-xss-protection: 1; mode=block
cf-cache-status: HIT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 444114bb3fc871b5-ORD

HTTP/2 200 
date: Thu, 02 Aug 2018 14:02:13 GMT
content-type: text/html; charset=utf-8
cache-control: max-age=600
content-security-policy: script-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com 'unsafe-inline' 'unsafe-eval' www.googletagmanager.com www.google-analytics.com tagmanager.google.com www.youtube.com s.ytimg.com; img-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com data: mozilla.org www.googletagmanager.com www.google-analytics.com creativecommons.org ad.doubleclick.net; default-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com; frame-src www.googletagmanager.com www.google-analytics.com www.youtube-nocookie.com trackertest.org www.surveygizmo.com accounts.firefox.com accounts.firefox.com.cn www.youtube.com; style-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com 'unsafe-inline' fast.fonts.net; connect-src 'self' *.mozilla.net *.mozilla.org *.mozilla.com www.googletagmanager.com www.google-analytics.com; child-src www.googletagmanager.com www.google-analytics.com www.youtube-nocookie.com trackertest.org www.surveygizmo.com accounts.firefox.com accounts.firefox.com.cn www.youtube.com
etag: "9333e751092811efe4d73c2b9a8ee88e"
expires: Wed, 25 Jul 2018 21:52:32 GMT
strict-transport-security: max-age=31536000
x-backend-server: bedrock-prod-web-557cbd9d9d-zgb8n.bedrock-prod.oregon-b.moz.works
x-clacks-overhead: GNU Terry Pratchett
x-content-type-options: nosniff
x-frame-options: DENY
x-robots-tag: noodp
x-xss-protection: 1; mode=block
cf-cache-status: HIT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 444114bb7ff171b5-ORD

I get the strict-transport-security header. My theory is the x-backend-server is the key - if it is *.bedrock-prod.oregon-b.moz.works, you get the HSTS header, and if you get *.iowa-a you don't.

[pmac]

@jwhitlock brilliant! I'll bet that's it. @jgmize looks like bedrock-prod in Iowa isn't configured properly. Let's take a look at that soon.

[pmac]

SECURE_HSTS_SECONDS should be set to 31536000.

[pmac]

Looks like it's actually missing from Iowa, Tokyo, and Frankfurt :(

[jgmize]

pushed https://github.com/mozmeao/www-config/commit/71b9bc46530a5e500c381302bf5b71eec249d84c and will verify the fix in dev shortly before proceeding to stage and then prod

[jgmize]

curl -Is https://bedrock-dev.gcp.moz.works | grep strict-transport-security
strict-transport-security: max-age=31536000

curl -Is https://bedrock-dev.frankfurt.moz.works | grep strict-transport-security
strict-transport-security: max-age=31536000



md5-f5597dcb06c72d6d00484061e5845729



curl -Is https://bedrock-dev.tokyo.moz.works | grep strict-transport-security
strict-transport-security: max-age=31536000

[jgmize]

$ curl -Is https://bedrock-stage.gcp.moz.works | grep strict-transport-security
strict-transport-security: max-age=31536000

$ curl -Is https://bedrock-stage.frankfurt.moz.works | grep strict-transport-security
strict-transport-security: max-age=31536000



md5-f5597dcb06c72d6d00484061e5845729



$ curl -Is https://bedrock-stage.tokyo.moz.works | grep strict-transport-security
strict-transport-security: max-age=31536000



md5-f5597dcb06c72d6d00484061e5845729



$ curl -Is https://bedrock-stage.oregon-b.moz.works | grep strict-transport-security
strict-transport-security: max-age=31536000



md5-f5597dcb06c72d6d00484061e5845729



$ curl -Is https://www.allizom.org | grep strict-transport-security
strict-transport-security: max-age=31536000

[jgmize]

$ curl -Is https://bedrock-prod.oregon-b.moz.works | grep strict-transport-security
strict-transport-security: max-age=31536000
$ curl -Is https://bedrock-prod.gcp.moz.works | grep strict-transport-security
strict-transport-security: max-age=31536000
$ curl -Is https://bedrock-prod.frankfurt.moz.works | grep strict-transport-security
strict-transport-security: max-age=31536000
$ curl -Is https://bedrock-prod.tokyo.moz.works | grep strict-transport-security
strict-transport-security: max-age=31536000

[jgmize]

still waiting on cache expiration for the header to propagate through the CDN

[pmac]

Fantastic 🎉 Once that happens we can trigger a re-scan at the Observatory.

[jgmize]

https://observatory.mozilla.org/analyze/mozilla.org is now green for HSTS.

[april]

Thanks for taking care of this, everyone!