search

nasa / api-docs

api.nasa.gov
http://nasa.github.io/api-docs/
450 stars 109 forks source link

Enforce HTTP Strict Transport Security on api.nasa.gov #74

Closed martinsuchan closed 7 years ago

martinsuchan commented 8 years ago

For better security and for preventing various Protocol Downgrade Attacks the endpoint api.nasa.gov should enforce HTTP Strict Transport Security - add response header indicating that all communication should always happen on HTTPS. Since api.nasa.gov works already only on HTTPS, adding HSTS should not break anythng, only imrpove the security for all the clients. For more details about HSTS please check this article: https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security

jnbetancourt commented 7 years ago

NASA APIs now enforce strict transport security. Thanks for the suggestion!