Skip to content
This repository has been archived by the owner on Nov 6, 2023. It is now read-only.

HTTPS to HTTPS 40 Rules Refactor #16924

Merged
merged 24 commits into from
Nov 1, 2018
Merged

Conversation

zoracon
Copy link
Contributor

@zoracon zoracon commented Oct 18, 2018

Background:
There were quite a few older rules supporting HTTPS to HTTPS redirects that we generally would like to clean and move towards a safer and more reliable service as an extension.

The Concerns:

  • There were some rulesets that had HTTPS to HTTPS redirects, causing the potential shady realm of valid urls being pointed to places they potentially should not
  • Some of these rulesets were originally acting as a redirect service for site devs/admins who may not have properly routed their CDNs
  • Many of these rulesets come from more older conventions of the encrypted web
  • For example:
  1. When site devs forgot to add www and proper redirects to the host from www urls
  2. secure.example.com urls

Reasoning:

  1. The main reason is to truly return to the initial nature of the plugin. And that is to safely port the user from un-encrypted to encrypted connections.
  2. Many of the original concerns around bad SSL errors have been addressed with: Disable per site #16546
  3. Also, there is a future for the plugin to serve in other capacities. And for that to happen as a reliable source in these plans, we need to work together to make sure the plugin does exactly as intended.
  4. This cleaning also reaffirms our promise to the user that the plugin does exactly what it says

Plan

  1. I will tag in and reference the original contributors for certain complex rulesets before any changes get merged in
  2. As review occurs, I will keep up tests for the rulesets as any changes that may come in
  3. After testing, we can move forward to merge

@J0WI
Copy link
Contributor

J0WI commented Oct 24, 2018

I did not yet review all files, but here are some things I noticed:

  • Is it worth to apply these updates to default_off rules?
  • Applying a generic redirect to a rule that contains a wildcard target can have negative side effects (breaking not yet listed subdomains).

@zoracon
Copy link
Contributor Author

zoracon commented Oct 26, 2018

I did not yet review all files, but here are some things I noticed:

* Is it worth to apply these updates to `default_off` rules?

* Applying a generic redirect to a rule that contains a wildcard target can have negative side effects (breaking not yet listed subdomains).

I can definitely go back and leave the ones that were already off. I must admit, I started these changes when I didn't fully get the default off feature, but now I do. So I can condense the PR some for that. I can go back over the rulesets that had wildcards and see what can be amended there as well. Thank you for the feedback.

The changes here are not needed since these rules were previously turned off
@zoracon zoracon merged commit 7b27444 into EFForg:master Nov 1, 2018
zoracon added a commit to zoracon/https-everywhere that referenced this pull request Nov 1, 2018
jsha pushed a commit that referenced this pull request Nov 2, 2018
@zoracon zoracon deleted the https-from-refactor branch November 14, 2018 22:54
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants