Page MenuHomePhabricator

Enable HSTS on Wikimedia sites
Closed, ResolvedPublic

Description

[[HTTP Strict Transport Security]] tells a user's browser to load all resources for a website over HTTPS, even if the resources are referenced with an "http://" URI. More information at http://www.imperialviolet.org/2012/07/19/hope9talk.html

See Also:

Details

Reference
bz38516
Related Gerrit Patches:
operations/puppet : productionHSTS: increase to 1y, do not allow applayer override
operations/puppet : productionEnable HSTS on racktables with max-age=7days
operations/puppet : productionpeople - Raise HSTS max-age to 1 year
operations/puppet : productionnoc - Raise HSTS max-age to 1 year
operations/puppet : productionnoc - redirect HTTP to HTTPS; enable HSTS 7 days
operations/puppet : productiontransparency - Raise HSTS max-age to 1 year
operations/puppet : productiontransparency: make it HTTPS only and enable HSTS
operations/puppet : productionintegration - Raise HSTS max-age to 1 year
operations/puppet : productiondoc - Raise HSTS max-age to 1 year
operations/puppet : productionishmael - Raise HSTS max-age to 1 year and add "always"
operations/puppet : productioniegreview - Raise HSTS max-age to 1 year and add "always"
operations/puppet : productionannual - Raise HSTS max-age to 1 year and add "always"
operations/puppet : productionservermon - Raise HSTS max-age to 1 year
operations/puppet : productiondonate - Raise HSTS max-age to 1 year
operations/puppet : productionRT - Raise HSTS max-age to 1 year
operations/puppet : productionintegration - Enable HSTS max-age=7 days
operations/puppet : productiondoc - Enable HSTS max-age=7 days
operations/puppet : productiondonate - Enable HSTS max-age=7 days
operations/puppet : productionscholarships - Increase HSTS max-age to 1 year
operations/puppet : productiongdash - Enable HSTS max-age=7 days
operations/puppet : productiondbtree - Raise HSTS max-age to 1 year and add always flag
operations/puppet : productionAdd "always" flag when add HSTS header in Apache
operations/puppet : productionRT - Enable HSTS max-age=7 days
operations/puppet : productionishmael - Enable HSTS max-age=7 days
operations/puppet : productioniegreview - Enable HSTS max-age=7 days
operations/puppet : productionannual - Enable HSTS max-age=7 days
operations/puppet : productiondbtree - Enable HSTS max-age=7 days
operations/puppet : productionservermon - Enable HSTS max-age=7 days
operations/puppet : productiontendril - Increase HSTS max-age to 1 year
operations/puppet : productiondev.wm.org - Increase HSTS max-age to 1 year
operations/puppet : productionEnable HSTS on dev.wm.org max-age=7 days
operations/puppet : productionEnable HSTS on tendril with max-age=7days

Related Objects

StatusAssignedTask
OpenBBlack
ResolvedBBlack
ResolvedBBlack
ResolvedNone
DeclinedKrinkle
ResolvedJgreen
ResolvedChmarkine
ResolvedBBlack
ResolvedBBlack
ResolvedBBlack
ResolvedBBlack
ResolvedKrenair
ResolvedJgreen
ResolvedRobH
DuplicateNone
ResolvedBBlack
InvalidNone
ResolvedBBlack
ResolvedDzahn
Resolved ezachte
ResolvedBBlack
ResolvedBBlack
ResolvedBBlack
ResolvedBBlack
ResolvedBBlack
ResolvedBBlack
ResolvedBBlack
ResolvedDzahn

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes

Change 199142 merged by Dzahn:
iegreview - Enable HSTS max-age=7 days

https://gerrit.wikimedia.org/r/199142

greg removed a subscriber: greg.Mar 26 2015, 2:59 PM

Change 202267 had a related patch set uploaded (by Chmarkine):
dbtree - Raise HSTS max-age to 1 year and add always flag

https://gerrit.wikimedia.org/r/202267

Change 198457 merged by BBlack:
ishmael - Enable HSTS max-age=7 days

https://gerrit.wikimedia.org/r/198457

Change 198455 merged by BBlack:
RT - Enable HSTS max-age=7 days

https://gerrit.wikimedia.org/r/198455

Change 199319 merged by BBlack:
Add "always" flag when add HSTS header in Apache

https://gerrit.wikimedia.org/r/199319

Change 202267 merged by Dzahn:
dbtree - Raise HSTS max-age to 1 year and add always flag

https://gerrit.wikimedia.org/r/202267

Change 198469 merged by BBlack:
gdash - Enable HSTS max-age=7 days

https://gerrit.wikimedia.org/r/198469

Change 199126 merged by Dzahn:
scholarships - Increase HSTS max-age to 1 year

https://gerrit.wikimedia.org/r/199126

Change 199200 merged by BBlack:
donate - Enable HSTS max-age=7 days

https://gerrit.wikimedia.org/r/199200

Change 198819 merged by Dzahn:
doc - Enable HSTS max-age=7 days

https://gerrit.wikimedia.org/r/198819

Change 198458 merged by BBlack:
integration - Enable HSTS max-age=7 days

https://gerrit.wikimedia.org/r/198458

Change 206977 had a related patch set uploaded (by Chmarkine):
RT - Raise HSTS max-age to 1 year

https://gerrit.wikimedia.org/r/206977

Change 206979 had a related patch set uploaded (by Chmarkine):
donate - Raise HSTS max-age to 1 year

https://gerrit.wikimedia.org/r/206979

Change 206980 had a related patch set uploaded (by Chmarkine):
doc - Raise HSTS max-age to 1 year

https://gerrit.wikimedia.org/r/206980

Change 206981 had a related patch set uploaded (by Chmarkine):
integration - Raise HSTS max-age to 1 year

https://gerrit.wikimedia.org/r/206981

Change 206982 had a related patch set uploaded (by Chmarkine):
servermon - Raise HSTS max-age to 1 year

https://gerrit.wikimedia.org/r/206982

Change 206983 had a related patch set uploaded (by Chmarkine):
iegreview - Raise HSTS max-age to 1 year

https://gerrit.wikimedia.org/r/206983

Change 206984 had a related patch set uploaded (by Chmarkine):
annual - Raise HSTS max-age to 1 year and add "always"

https://gerrit.wikimedia.org/r/206984

Change 206992 had a related patch set uploaded (by Chmarkine):
ishmael - Raise HSTS max-age to 1 year and add "always"

https://gerrit.wikimedia.org/r/206992

Change 206977 merged by BBlack:
RT - Raise HSTS max-age to 1 year

https://gerrit.wikimedia.org/r/206977

Change 206979 merged by BBlack:
donate - Raise HSTS max-age to 1 year

https://gerrit.wikimedia.org/r/206979

Change 206982 merged by BBlack:
servermon - Raise HSTS max-age to 1 year

https://gerrit.wikimedia.org/r/206982

Change 206984 merged by BBlack:
annual - Raise HSTS max-age to 1 year and add "always"

https://gerrit.wikimedia.org/r/206984

Change 206983 merged by BBlack:
iegreview - Raise HSTS max-age to 1 year and add "always"

https://gerrit.wikimedia.org/r/206983

Change 206992 merged by BBlack:
ishmael - Raise HSTS max-age to 1 year and add "always"

https://gerrit.wikimedia.org/r/206992

Change 206980 merged by BBlack:
doc - Raise HSTS max-age to 1 year

https://gerrit.wikimedia.org/r/206980

Change 206981 merged by BBlack:
integration - Raise HSTS max-age to 1 year

https://gerrit.wikimedia.org/r/206981

Change 199517 merged by BBlack:
transparency: make it HTTPS only and enable HSTS

https://gerrit.wikimedia.org/r/199517

Why aren't the Vary and HSTS headers set for https://gdash.wikimedia.org, but are correctly set for http://gdash.wikimedia.org?

For these requests the apache config has "SetHandler uwsgi-handler", which makes header set not work. https://uwsgi-docs.readthedocs.org/en/latest/Apache.html?highlight=assbackwards hints as this when it says "If you do not use Apache2 filters". The early keyword for headers might help. OTOH https://httpd.apache.org/docs/2.4/mod/mod_headers.html#early says "Always use Late mode in an operational server." so perhaps it is a better idea to use cgi instead of assbackwards mode of uwsgi.

Change 211394 had a related patch set uploaded (by Chmarkine):
transparency - Raise HSTS max-age to 1 year

https://gerrit.wikimedia.org/r/211394

Change 211394 merged by BBlack:
transparency - Raise HSTS max-age to 1 year

https://gerrit.wikimedia.org/r/211394

Change 199515 merged by BBlack:
noc - redirect HTTP to HTTPS; enable HSTS 7 days

https://gerrit.wikimedia.org/r/199515

Change 213976 had a related patch set uploaded (by Chmarkine):
noc - Raise HSTS max-age to 1 year

https://gerrit.wikimedia.org/r/213976

Change 213976 merged by BBlack:
noc - Raise HSTS max-age to 1 year

https://gerrit.wikimedia.org/r/213976

Change 217557 had a related patch set uploaded (by Chmarkine):
people - Raise HSTS max-age to 1 year

https://gerrit.wikimedia.org/r/217557

Change 217557 merged by BBlack:
people - Raise HSTS max-age to 1 year

https://gerrit.wikimedia.org/r/217557

I noticed that HSTS was enabled for English Wikipedia following the announcements here. But why is the max-age only 1 day? Is that just for now while we test it out?

But why is the max-age only 1 day? Is that just for now while we test it out?

Probably yes. The ability to quickly assess and revert the change has been pointed out several times by ops on T49832.

But why is the max-age only 1 day? Is that just for now while we test it out?

Probably yes. The ability to quickly assess and revert the change has been pointed out several times by ops on T49832.

Got it. Thanks Nemo!

BBlack added a subscriber: BBlack.Jun 16 2015, 5:29 PM

Right. At this point for the primary clusters we're 1-3 day values for HSTS for the recently-HTTPS'd domains. We'll be raising those values slowly over time. HSTS is awesome, but also scary, because you can't really take that back once you've sent it to a client :)

Change 195444 abandoned by Chmarkine:
Enable HSTS on racktables with max-age=7days

Reason:
HSTS will be added to all services behind misc-web centrally.

https://phabricator.wikimedia.org/T103919

https://gerrit.wikimedia.org/r/195444

BBlack added a comment.Jul 2 2015, 2:16 PM

Update on the above: we've been advertising a 6-month HSTS on all primary production sites since Jun 26. Does not include all "misc" services as noted above.

Change 222301 had a related patch set uploaded (by BBlack):
HSTS: increase to 1y, do not allow applayer override

https://gerrit.wikimedia.org/r/222301

Change 222301 merged by BBlack:
HSTS: increase to 1y, do not allow applayer override

https://gerrit.wikimedia.org/r/222301

Restricted Application added a subscriber: Matanya. · View Herald TranscriptAug 7 2015, 5:00 PM
BBlack moved this task from Triage to In Progress on the Traffic board.Aug 8 2015, 4:38 PM
BBlack moved this task from In Progress to Up Next on the Traffic board.Nov 30 2015, 6:03 PM
Dzahn moved this task from Backlog to Big Picture on the HTTPS board.Dec 4 2015, 8:43 PM

Note: this is already the case with two exceptions:

  1. We're not sending HSTS (or even forcing HTTPS) on all of cache_misc's service hostnames yet
  2. We're not sending HSTS for the *.donate.wikimedia.org hostnames, about to be removed shortly in T130414

I should've added:

  1. We're also not convered for redirect/HSTS on all the non-cache_misc direct services
He7d3r updated the task description. (Show Details)Apr 12 2016, 4:42 PM
Krinkle removed a subscriber: Krinkle.Apr 13 2016, 2:58 AM
BBlack closed this task as Resolved.Jun 14 2016, 10:04 PM
BBlack claimed this task.

This is done for all the reasonable cases we have direct control of. The external-ish ones are tracked in task T132521 and on wikitech at https://wikitech.wikimedia.org/wiki/HTTPS/domains