Find a home for HTTPS guidelines

[18f]

Find a home for HTTPS guidelines

[konklone]

From a conversation prior, so it's recorded:

Many .gov sites will start to pull from dap.digitalgov.gov to reference the DAP's JavaScript site. Because it's a high-value target, the domain will enforce HTTPS and add HSTS headers. However, a couple HTTP sites who have embedded it used protocol-relative URLs, even though the site enforced HTTPS, because protocol-relative URLs are such common practice.

For a third party service with that high of a footprint in the federal government, allowing people to use insecure redirects (which would allow any network to trivially hijack requests) is a non-starter. The subdomain is new and hasn't been used before, so the ideal would be to shut off port 80 altogether. However, that's challenging for a CDN, which hosts many sites on the same IP addresses, to do.

A 403 error for all HTTP requests would not have met the standard set out in https.cio.gov, where HTTP should be used only for redirects. That requirement is helpful both to encourage secure behavior and make auditing simpler.

So, DAP is now combining a redirect with a 403, so that any HTTP request is redirected to HTTPS with a path of /403/ with a 403 status code. Requests that begin as HTTPS work as normal. This meets requirements, while also ensuring that agencies must use an https:// URL to do the reference (or use a protocol-relative URL on an HTTPS site) for the reference to work and for data reporting to operate.

So basically, this intentionally breaks protocol-relative URLs as a pattern that many (most) agencies can use for this JS file. Disabling port 80 would also have done this. For high-sensitivity domains whose URLs people aren't typing into their browser, and where there's no legacy use of HTTP to worry about, look at disabling HTTP, or a workaround like the above, as an option.

[xtine]

https://pulse.cio.gov/https/guidance/

[konklone]

@xtine I forget the full context of this thread, but the text I quoted above isn't contained in the link above.

[xtine]

@konklone: In housekeeping of guild issues, I hastily closed this issue but I am following up on this now. I put the Pulse link as another resource of HTTPS guidance.

I'm not sure where this information should live as doesn't fit to be in the Front End Guide, but seems like knowledge we should have somewhere.
@meiqimichelle: any ideas?