-
Notifications
You must be signed in to change notification settings - Fork 87
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore: make hsts header follow recommendation from csa #6106
Conversation
Description of check in csa scanner: The scanner checks if your website offers HSTS. It checks for the existence of a “strict transport security header“ with max-age >= 1yr, and the existence of "include subdomains“ in your website’s response header.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm, can I just confirm that include subdomains
is currently also activated?
Yes it is, this was the value of the header in the CSA report:
|
I've updated HSTS in Cloudflare itself as well directly, so the scanner is already happy about that setting, but I'll still merge this to show in code that we want > 1year max-age. |
5d4ac60
to
f31b061
Compare
* fix(deps): bump type-fest from 3.7.2 to 3.8.0 in /shared (#6064) Bumps [type-fest](https://github.com/sindresorhus/type-fest) from 3.7.2 to 3.8.0. - [Release notes](https://github.com/sindresorhus/type-fest/releases) - [Commits](sindresorhus/type-fest@v3.7.2...v3.8.0) --- updated-dependencies: - dependency-name: type-fest dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(deps): bump vm2 from 3.9.11 to 3.9.15 (#6075) Bumps [vm2](https://github.com/patriksimek/vm2) from 3.9.11 to 3.9.15. - [Release notes](https://github.com/patriksimek/vm2/releases) - [Changelog](https://github.com/patriksimek/vm2/blob/master/CHANGELOG.md) - [Commits](patriksimek/vm2@3.9.11...3.9.15) --- updated-dependencies: - dependency-name: vm2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump @typescript-eslint/parser from 5.57.1 to 5.58.0 in /shared (#6083) chore(deps-dev): bump @typescript-eslint/parser in /shared Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 5.57.1 to 5.58.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.58.0/packages/parser) --- updated-dependencies: - dependency-name: "@typescript-eslint/parser" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump @typescript-eslint/eslint-plugin from 5.57.1 to 5.58.0 in /shared (#6082) chore(deps-dev): bump @typescript-eslint/eslint-plugin in /shared Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 5.57.1 to 5.58.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.58.0/packages/eslint-plugin) --- updated-dependencies: - dependency-name: "@typescript-eslint/eslint-plugin" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(deps): bump vm2 from 3.9.15 to 3.9.16 (#6092) Bumps [vm2](https://github.com/patriksimek/vm2) from 3.9.15 to 3.9.16. - [Release notes](https://github.com/patriksimek/vm2/releases) - [Changelog](https://github.com/patriksimek/vm2/blob/master/CHANGELOG.md) - [Commits](patriksimek/vm2@3.9.15...3.9.16) --- updated-dependencies: - dependency-name: vm2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump @types/lodash from 4.14.192 to 4.14.194 in /shared (#6100) Bumps [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) from 4.14.192 to 4.14.194. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash) --- updated-dependencies: - dependency-name: "@types/lodash" dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: prune error logs for ndi oidc key retrieval error (#6098) * chore: prune error logs for oidc key retrieval error * chore: handle undefined * chore(deps-dev): bump @typescript-eslint/parser from 5.58.0 to 5.59.0 in /shared (#6105) chore(deps-dev): bump @typescript-eslint/parser in /shared Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 5.58.0 to 5.59.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.59.0/packages/parser) --- updated-dependencies: - dependency-name: "@typescript-eslint/parser" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: date-picker bug for negative UTC timezones (#6096) * fix: remove timezone from datepicker * fix: datepicker bugs due to timezones - (FE) normalize dates to UTC before storing in DB - (FE) load normalized dates to local timezone - (BE) remove adjustments due to timezone * docs: futureOnly and pastOnly validators * refactor: allow null inputs for new date util fns * fix: date normalization fns to use date as numbers * refactor: remove unnecessary var assignment * fix: unset date validation * fix: compare to dates in earliest & latest tzs * fix(deps): bump libphonenumber-js from 1.10.26 to 1.10.28 in /shared (#6119) Bumps [libphonenumber-js](https://gitlab.com/catamphetamine/libphonenumber-js) from 1.10.26 to 1.10.28. - [Release notes](https://gitlab.com/catamphetamine/libphonenumber-js/tags) - [Changelog](https://gitlab.com/catamphetamine/libphonenumber-js/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/catamphetamine/libphonenumber-js/compare/v1.10.26...v1.10.28) --- updated-dependencies: - dependency-name: libphonenumber-js dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump @typescript-eslint/eslint-plugin from 5.58.0 to 5.59.0 in /shared (#6104) chore(deps-dev): bump @typescript-eslint/eslint-plugin in /shared Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 5.58.0 to 5.59.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.59.0/packages/eslint-plugin) --- updated-dependencies: - dependency-name: "@typescript-eslint/eslint-plugin" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: track nodejs runtime metrics in APM (#6120) * fix(deps): bump xml2js and aws-sdk (#6084) Bumps [xml2js](https://github.com/Leonidas-from-XIV/node-xml2js) to 0.5.0 and updates ancestor dependency [aws-sdk](https://github.com/aws/aws-sdk-js). These dependencies need to be updated together. Updates `xml2js` from 0.4.19 to 0.5.0 - [Release notes](https://github.com/Leonidas-from-XIV/node-xml2js/releases) - [Commits](Leonidas-from-XIV/node-xml2js@0.4.19...0.5.0) Updates `aws-sdk` from 2.1282.0 to 2.1354.0 - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.1282.0...v2.1354.0) --- updated-dependencies: - dependency-name: xml2js dependency-type: indirect - dependency-name: aws-sdk dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: make hsts header follow recommendation from csa (#6106) * chore: make hsts header follow recommendation from csa Description of check in csa scanner: The scanner checks if your website offers HSTS. It checks for the existence of a “strict transport security header“ with max-age >= 1yr, and the existence of "include subdomains“ in your website’s response header. * fix: fix test with new HSTS value * chore: bump version to v6.41.0 --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Justyn Oh <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: tshuli <[email protected]> Co-authored-by: Lin Huiqing <[email protected]> Co-authored-by: Timothee Groleau <[email protected]>
* build: release v6.41.0 (#6128) * fix(deps): bump type-fest from 3.7.2 to 3.8.0 in /shared (#6064) Bumps [type-fest](https://github.com/sindresorhus/type-fest) from 3.7.2 to 3.8.0. - [Release notes](https://github.com/sindresorhus/type-fest/releases) - [Commits](sindresorhus/type-fest@v3.7.2...v3.8.0) --- updated-dependencies: - dependency-name: type-fest dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(deps): bump vm2 from 3.9.11 to 3.9.15 (#6075) Bumps [vm2](https://github.com/patriksimek/vm2) from 3.9.11 to 3.9.15. - [Release notes](https://github.com/patriksimek/vm2/releases) - [Changelog](https://github.com/patriksimek/vm2/blob/master/CHANGELOG.md) - [Commits](patriksimek/vm2@3.9.11...3.9.15) --- updated-dependencies: - dependency-name: vm2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump @typescript-eslint/parser from 5.57.1 to 5.58.0 in /shared (#6083) chore(deps-dev): bump @typescript-eslint/parser in /shared Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 5.57.1 to 5.58.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.58.0/packages/parser) --- updated-dependencies: - dependency-name: "@typescript-eslint/parser" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump @typescript-eslint/eslint-plugin from 5.57.1 to 5.58.0 in /shared (#6082) chore(deps-dev): bump @typescript-eslint/eslint-plugin in /shared Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 5.57.1 to 5.58.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.58.0/packages/eslint-plugin) --- updated-dependencies: - dependency-name: "@typescript-eslint/eslint-plugin" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(deps): bump vm2 from 3.9.15 to 3.9.16 (#6092) Bumps [vm2](https://github.com/patriksimek/vm2) from 3.9.15 to 3.9.16. - [Release notes](https://github.com/patriksimek/vm2/releases) - [Changelog](https://github.com/patriksimek/vm2/blob/master/CHANGELOG.md) - [Commits](patriksimek/vm2@3.9.15...3.9.16) --- updated-dependencies: - dependency-name: vm2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump @types/lodash from 4.14.192 to 4.14.194 in /shared (#6100) Bumps [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) from 4.14.192 to 4.14.194. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash) --- updated-dependencies: - dependency-name: "@types/lodash" dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: prune error logs for ndi oidc key retrieval error (#6098) * chore: prune error logs for oidc key retrieval error * chore: handle undefined * chore(deps-dev): bump @typescript-eslint/parser from 5.58.0 to 5.59.0 in /shared (#6105) chore(deps-dev): bump @typescript-eslint/parser in /shared Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 5.58.0 to 5.59.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.59.0/packages/parser) --- updated-dependencies: - dependency-name: "@typescript-eslint/parser" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: date-picker bug for negative UTC timezones (#6096) * fix: remove timezone from datepicker * fix: datepicker bugs due to timezones - (FE) normalize dates to UTC before storing in DB - (FE) load normalized dates to local timezone - (BE) remove adjustments due to timezone * docs: futureOnly and pastOnly validators * refactor: allow null inputs for new date util fns * fix: date normalization fns to use date as numbers * refactor: remove unnecessary var assignment * fix: unset date validation * fix: compare to dates in earliest & latest tzs * fix(deps): bump libphonenumber-js from 1.10.26 to 1.10.28 in /shared (#6119) Bumps [libphonenumber-js](https://gitlab.com/catamphetamine/libphonenumber-js) from 1.10.26 to 1.10.28. - [Release notes](https://gitlab.com/catamphetamine/libphonenumber-js/tags) - [Changelog](https://gitlab.com/catamphetamine/libphonenumber-js/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/catamphetamine/libphonenumber-js/compare/v1.10.26...v1.10.28) --- updated-dependencies: - dependency-name: libphonenumber-js dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump @typescript-eslint/eslint-plugin from 5.58.0 to 5.59.0 in /shared (#6104) chore(deps-dev): bump @typescript-eslint/eslint-plugin in /shared Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 5.58.0 to 5.59.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.59.0/packages/eslint-plugin) --- updated-dependencies: - dependency-name: "@typescript-eslint/eslint-plugin" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: track nodejs runtime metrics in APM (#6120) * fix(deps): bump xml2js and aws-sdk (#6084) Bumps [xml2js](https://github.com/Leonidas-from-XIV/node-xml2js) to 0.5.0 and updates ancestor dependency [aws-sdk](https://github.com/aws/aws-sdk-js). These dependencies need to be updated together. Updates `xml2js` from 0.4.19 to 0.5.0 - [Release notes](https://github.com/Leonidas-from-XIV/node-xml2js/releases) - [Commits](Leonidas-from-XIV/node-xml2js@0.4.19...0.5.0) Updates `aws-sdk` from 2.1282.0 to 2.1354.0 - [Release notes](https://github.com/aws/aws-sdk-js/releases) - [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md) - [Commits](aws/aws-sdk-js@v2.1282.0...v2.1354.0) --- updated-dependencies: - dependency-name: xml2js dependency-type: indirect - dependency-name: aws-sdk dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: make hsts header follow recommendation from csa (#6106) * chore: make hsts header follow recommendation from csa Description of check in csa scanner: The scanner checks if your website offers HSTS. It checks for the existence of a "strict transport security header" with max-age >= 1yr, and the existence of "include subdomains" in your website’s response header. * fix: fix test with new HSTS value * chore: bump version to v6.41.0 --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Justyn Oh <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: tshuli <[email protected]> Co-authored-by: Lin Huiqing <[email protected]> Co-authored-by: Timothee Groleau <[email protected]> * build: release v6.41.1 (#6134) chore: bump version to 6.41.1 --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Foo Chi Fa <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: tshuli <[email protected]> Co-authored-by: Lin Huiqing <[email protected]> Co-authored-by: Timothee Groleau <[email protected]> Co-authored-by: Ken Lee Shu Ming <[email protected]>
Problem
We want to increase our domain score on CSA: https://ihp.csa.gov.sg/home
form.gov.sg is failing the HSTS check because our header
Strict-Transport-Security
has a max-age of 60 days instead of the recommendation of >= 1 year.Solution
Extend
max-age
ofStrict-Transport-Security
header to 400 days, to be greater than a year.Breaking Changes