mozilla/fxa

accounts.firefox.com sends two HSTS headers

hannob opened this issue · 5 comments

hannob commented

Description

accounts.firefox.com sends two strict-transport-security headers, one with and one without includeSubDomains. This is a misconfiguration.

Steps to reproduce

curl -sI https://accounts.firefox.com/|grep -i ^strict-transport-security

Output:

strict-transport-security: max-age=31536000; includeSubDomains
strict-transport-security: max-age=31536000

Expected result

HSTS header should be sent only once.

Actual result

Two different HSTS headers are sent with different scopes.

Misc

I do not believe that this is a security problem. However, it could've been easily been, possilby if they were sent in different order.

It appears browsers use the first header sent, or consider the preload list. Therefore, the header with the larger scope, i.e. includeSubDomains, is used.

┆Issue is synchronized with this Jira Task

clouserw commented

Thanks for filing this!

chenba commented

@hannob Thank you for filing the issue. You were correct that it was a misconfiguration. It's been fixed.

hannob commented

FWIW, it's not fixed:

$ curl -sI https://accounts.firefox.com/|grep -i ^strict-transport-security
strict-transport-security: max-age=31536000; includeSubDomains
strict-transport-security: max-age=31536000
clouserw commented

It'll be fixed with our next deploy on March 6

clouserw commented

This is live now. Thanks again