Www.rust-lang.org: Redirect http to https

[alexcrichton]

Heroku's hosting gives us https for the website, but it's up to us to redirect to it if accessed over http. We'll need to manually add a redirect from http://beta.rust-lang.org to https://beta.rust-lang.org/ (accounting for other hostnames once we've fully moved!)

This is a pretty minor issue, but just wanted to make sure it was catalogued!

[alexcrichton]

I've tried to look into this and have concluded that Heroku doesn't provide this feature for us but rather we need to do it at the application level. Currently this is a Rocket application which means we'd need Rocket to issue the redirect, but I haven't been able to learn how to configure Rocket to have this redirect for all routes.

I'm gonna unassign myself as I don't think I have time to dig that far into Rocket right now unfortunately

[nagisa]

Note, that this is not as trivial as "just" redirecting. There are more considerations to make there… For example, do we want to prevent possibility of MiTM for this redirect (after the very first visit)? In that case HSTS should be set-up as well… however, it should only done if we trust ourselves to correctly manage our certs correctly and never mess up handling them.

[pietroalbini]

In that case HSTS should be set-up as well…

And we can't preload it, since some of our subdomains (like ping.rl.o) don't have support for HTTPS.

[Darkspirit]

Please put rust-lang.org and rustup.sh like Servo behind Cloudflare. (Even Mozilla.org switched to it.) You may configure a Cloudflare origin certificate at Heroku. Benefits:

• HTTP to HTTPS redirect directly made at Cloudflare
• TLS 1.3
• Cloudflare + Firefox = ESNI
• reliable and modern DNSSEC based on ECDSA P-256
• You can still have ping.rust-lang.org. If Cloudflare itself would be down, the Internet would notice.
• You might be even able to compile the website to wasm and run it in a Cloudflare worker.

Please activate HSTS + preloading for rustup.rs as soon as possible. May I help somehow?

(Nicer would be of course not using such large centralized services and instead Mozilla IT, with own IPs etc. ^^)

[coder543]

I don't understand why the main website needs to have an active backend at all. Why can't it just be hosted directly on a CDN as static HTML/CSS/JS? A CDN would offer many of these features at no additional effort.

[Coder206]

I navigated to the HTTP version of the site with Firefox ESR, Firefox Nightly, Chromium (latest for Pop!OS), it redirected to HTTPS automatically.

[ashleygwilliams]

great! we can close now :)