search

denoland / dotland

[Archived] deno.land website
https://deno.land
MIT License
958 stars 627 forks source link

Preload HSTS #1656

Closed lgarron closed 3 years ago

lgarron commented 3 years ago

https://deno.land is sending an HSTS header indicating that it should be preloaded for HTTPS in browsers:

https://hstspreload.org/?domain=deno.land

Screen Shot 2021-01-30 at 20 02 51

If this is intended, it would be good to submit the form there!

(If this is not intended, I suggest removing the header as soon as possible, because anyone can submit the form.)

kidonng commented 3 years ago

@lucacasonato This issue should be resolved quickly, as both the submission for adding and removing can take months for most users to receive.

EDIT: oh I see it's not eligible now because HTTP to HTTPS redirect is turned off. I remember last time I saw this issue (some days ago) it's still eligible. Well turning redirection off is as bad as (and IMO more harmful than) being accidentally submitted to HSTS preload list. My guess is that it's turned off temporary for maintenance. If that's the case, please fix it and remove preload from the HSTS header, or submit it to the list if you do want to preload it.

lucacasonato commented 3 years ago

We serve without the preload attribute in the strict-transport-security header now.