Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: make hsts header follow recommendation from csa #6106

Merged
merged 2 commits into from
Apr 19, 2023

Conversation

timotheeg
Copy link
Contributor

Problem

We want to increase our domain score on CSA: https://ihp.csa.gov.sg/home

form.gov.sg is failing the HSTS check because our header Strict-Transport-Security has a max-age of 60 days instead of the recommendation of >= 1 year.

Solution

Extend max-age of Strict-Transport-Security header to 400 days, to be greater than a year.

Breaking Changes

  • Yes - this PR contains breaking changes
    • Details ...
  • No - this PR is backwards compatible

Description of check in csa scanner:
The scanner checks if your website offers HSTS. It checks for the existence of a “strict transport security header“ with max-age >= 1yr, and the existence of "include subdomains“ in your website’s response header.
Copy link
Contributor

@tshuli tshuli left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, can I just confirm that include subdomains is currently also activated?

@timotheeg
Copy link
Contributor Author

can I just confirm that include subdomains is currently also activated?

Yes it is, this was the value of the header in the CSA report:

Strict-Transport-Security: max-age=5184000; includeSubDomains

@timotheeg
Copy link
Contributor Author

I've updated HSTS in Cloudflare itself as well directly, so the scanner is already happy about that setting, but I'll still merge this to show in code that we want > 1year max-age.

@timotheeg timotheeg force-pushed the hsts_follows_recommendation_from_csa branch from 5d4ac60 to f31b061 Compare April 19, 2023 04:54
@foochifa foochifa merged commit 6820b25 into develop Apr 19, 2023
@foochifa foochifa deleted the hsts_follows_recommendation_from_csa branch April 19, 2023 05:22
@foochifa foochifa mentioned this pull request Apr 19, 2023
36 tasks
LinHuiqing added a commit that referenced this pull request Apr 19, 2023
* fix(deps): bump type-fest from 3.7.2 to 3.8.0 in /shared (#6064)

Bumps [type-fest](https://github.com/sindresorhus/type-fest) from 3.7.2 to 3.8.0.
- [Release notes](https://github.com/sindresorhus/type-fest/releases)
- [Commits](sindresorhus/type-fest@v3.7.2...v3.8.0)

---
updated-dependencies:
- dependency-name: type-fest
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix(deps): bump vm2 from 3.9.11 to 3.9.15 (#6075)

Bumps [vm2](https://github.com/patriksimek/vm2) from 3.9.11 to 3.9.15.
- [Release notes](https://github.com/patriksimek/vm2/releases)
- [Changelog](https://github.com/patriksimek/vm2/blob/master/CHANGELOG.md)
- [Commits](patriksimek/vm2@3.9.11...3.9.15)

---
updated-dependencies:
- dependency-name: vm2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps-dev): bump @typescript-eslint/parser from 5.57.1 to 5.58.0 in /shared (#6083)

chore(deps-dev): bump @typescript-eslint/parser in /shared

Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 5.57.1 to 5.58.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.58.0/packages/parser)

---
updated-dependencies:
- dependency-name: "@typescript-eslint/parser"
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps-dev): bump @typescript-eslint/eslint-plugin from 5.57.1 to 5.58.0 in /shared (#6082)

chore(deps-dev): bump @typescript-eslint/eslint-plugin in /shared

Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 5.57.1 to 5.58.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.58.0/packages/eslint-plugin)

---
updated-dependencies:
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix(deps): bump vm2 from 3.9.15 to 3.9.16 (#6092)

Bumps [vm2](https://github.com/patriksimek/vm2) from 3.9.15 to 3.9.16.
- [Release notes](https://github.com/patriksimek/vm2/releases)
- [Changelog](https://github.com/patriksimek/vm2/blob/master/CHANGELOG.md)
- [Commits](patriksimek/vm2@3.9.15...3.9.16)

---
updated-dependencies:
- dependency-name: vm2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps-dev): bump @types/lodash from 4.14.192 to 4.14.194 in /shared (#6100)

Bumps [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) from 4.14.192 to 4.14.194.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash)

---
updated-dependencies:
- dependency-name: "@types/lodash"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: prune error logs for ndi oidc key retrieval error (#6098)

* chore: prune error logs for oidc key retrieval error

* chore: handle undefined

* chore(deps-dev): bump @typescript-eslint/parser from 5.58.0 to 5.59.0 in /shared (#6105)

chore(deps-dev): bump @typescript-eslint/parser in /shared

Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 5.58.0 to 5.59.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.59.0/packages/parser)

---
updated-dependencies:
- dependency-name: "@typescript-eslint/parser"
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix: date-picker bug for negative UTC timezones (#6096)

* fix: remove timezone from datepicker

* fix: datepicker bugs due to timezones

- (FE) normalize dates to UTC before storing in DB
- (FE) load normalized dates to local timezone
- (BE) remove adjustments due to timezone

* docs: futureOnly and pastOnly validators

* refactor: allow null inputs for new date util fns

* fix: date normalization fns to use date as numbers

* refactor: remove unnecessary var assignment

* fix: unset date validation

* fix: compare to dates in earliest & latest tzs

* fix(deps): bump libphonenumber-js from 1.10.26 to 1.10.28 in /shared (#6119)

Bumps [libphonenumber-js](https://gitlab.com/catamphetamine/libphonenumber-js) from 1.10.26 to 1.10.28.
- [Release notes](https://gitlab.com/catamphetamine/libphonenumber-js/tags)
- [Changelog](https://gitlab.com/catamphetamine/libphonenumber-js/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/catamphetamine/libphonenumber-js/compare/v1.10.26...v1.10.28)

---
updated-dependencies:
- dependency-name: libphonenumber-js
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps-dev): bump @typescript-eslint/eslint-plugin from 5.58.0 to 5.59.0 in /shared (#6104)

chore(deps-dev): bump @typescript-eslint/eslint-plugin in /shared

Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 5.58.0 to 5.59.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.59.0/packages/eslint-plugin)

---
updated-dependencies:
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat: track nodejs runtime metrics in APM (#6120)

* fix(deps): bump xml2js and aws-sdk (#6084)

Bumps [xml2js](https://github.com/Leonidas-from-XIV/node-xml2js) to 0.5.0 and updates ancestor dependency [aws-sdk](https://github.com/aws/aws-sdk-js). These dependencies need to be updated together.


Updates `xml2js` from 0.4.19 to 0.5.0
- [Release notes](https://github.com/Leonidas-from-XIV/node-xml2js/releases)
- [Commits](Leonidas-from-XIV/node-xml2js@0.4.19...0.5.0)

Updates `aws-sdk` from 2.1282.0 to 2.1354.0
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](aws/aws-sdk-js@v2.1282.0...v2.1354.0)

---
updated-dependencies:
- dependency-name: xml2js
  dependency-type: indirect
- dependency-name: aws-sdk
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: make hsts header follow recommendation from csa (#6106)

* chore: make hsts header follow recommendation from csa

Description of check in csa scanner:
The scanner checks if your website offers HSTS. It checks for the existence of a “strict transport security header“ with max-age >= 1yr, and the existence of "include subdomains“ in your website’s response header.

* fix: fix test with new HSTS value

* chore: bump version to v6.41.0

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: Justyn Oh <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: tshuli <[email protected]>
Co-authored-by: Lin Huiqing <[email protected]>
Co-authored-by: Timothee Groleau <[email protected]>
LinHuiqing added a commit that referenced this pull request Apr 19, 2023
* build: release v6.41.0 (#6128)

* fix(deps): bump type-fest from 3.7.2 to 3.8.0 in /shared (#6064)

Bumps [type-fest](https://github.com/sindresorhus/type-fest) from 3.7.2 to 3.8.0.
- [Release notes](https://github.com/sindresorhus/type-fest/releases)
- [Commits](sindresorhus/type-fest@v3.7.2...v3.8.0)

---
updated-dependencies:
- dependency-name: type-fest
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix(deps): bump vm2 from 3.9.11 to 3.9.15 (#6075)

Bumps [vm2](https://github.com/patriksimek/vm2) from 3.9.11 to 3.9.15.
- [Release notes](https://github.com/patriksimek/vm2/releases)
- [Changelog](https://github.com/patriksimek/vm2/blob/master/CHANGELOG.md)
- [Commits](patriksimek/vm2@3.9.11...3.9.15)

---
updated-dependencies:
- dependency-name: vm2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps-dev): bump @typescript-eslint/parser from 5.57.1 to 5.58.0 in /shared (#6083)

chore(deps-dev): bump @typescript-eslint/parser in /shared

Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 5.57.1 to 5.58.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.58.0/packages/parser)

---
updated-dependencies:
- dependency-name: "@typescript-eslint/parser"
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps-dev): bump @typescript-eslint/eslint-plugin from 5.57.1 to 5.58.0 in /shared (#6082)

chore(deps-dev): bump @typescript-eslint/eslint-plugin in /shared

Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 5.57.1 to 5.58.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.58.0/packages/eslint-plugin)

---
updated-dependencies:
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix(deps): bump vm2 from 3.9.15 to 3.9.16 (#6092)

Bumps [vm2](https://github.com/patriksimek/vm2) from 3.9.15 to 3.9.16.
- [Release notes](https://github.com/patriksimek/vm2/releases)
- [Changelog](https://github.com/patriksimek/vm2/blob/master/CHANGELOG.md)
- [Commits](patriksimek/vm2@3.9.15...3.9.16)

---
updated-dependencies:
- dependency-name: vm2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps-dev): bump @types/lodash from 4.14.192 to 4.14.194 in /shared (#6100)

Bumps [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) from 4.14.192 to 4.14.194.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash)

---
updated-dependencies:
- dependency-name: "@types/lodash"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: prune error logs for ndi oidc key retrieval error (#6098)

* chore: prune error logs for oidc key retrieval error

* chore: handle undefined

* chore(deps-dev): bump @typescript-eslint/parser from 5.58.0 to 5.59.0 in /shared (#6105)

chore(deps-dev): bump @typescript-eslint/parser in /shared

Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 5.58.0 to 5.59.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.59.0/packages/parser)

---
updated-dependencies:
- dependency-name: "@typescript-eslint/parser"
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix: date-picker bug for negative UTC timezones (#6096)

* fix: remove timezone from datepicker

* fix: datepicker bugs due to timezones

- (FE) normalize dates to UTC before storing in DB
- (FE) load normalized dates to local timezone
- (BE) remove adjustments due to timezone

* docs: futureOnly and pastOnly validators

* refactor: allow null inputs for new date util fns

* fix: date normalization fns to use date as numbers

* refactor: remove unnecessary var assignment

* fix: unset date validation

* fix: compare to dates in earliest & latest tzs

* fix(deps): bump libphonenumber-js from 1.10.26 to 1.10.28 in /shared (#6119)

Bumps [libphonenumber-js](https://gitlab.com/catamphetamine/libphonenumber-js) from 1.10.26 to 1.10.28.
- [Release notes](https://gitlab.com/catamphetamine/libphonenumber-js/tags)
- [Changelog](https://gitlab.com/catamphetamine/libphonenumber-js/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/catamphetamine/libphonenumber-js/compare/v1.10.26...v1.10.28)

---
updated-dependencies:
- dependency-name: libphonenumber-js
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps-dev): bump @typescript-eslint/eslint-plugin from 5.58.0 to 5.59.0 in /shared (#6104)

chore(deps-dev): bump @typescript-eslint/eslint-plugin in /shared

Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 5.58.0 to 5.59.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.59.0/packages/eslint-plugin)

---
updated-dependencies:
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat: track nodejs runtime metrics in APM (#6120)

* fix(deps): bump xml2js and aws-sdk (#6084)

Bumps [xml2js](https://github.com/Leonidas-from-XIV/node-xml2js) to 0.5.0 and updates ancestor dependency [aws-sdk](https://github.com/aws/aws-sdk-js). These dependencies need to be updated together.


Updates `xml2js` from 0.4.19 to 0.5.0
- [Release notes](https://github.com/Leonidas-from-XIV/node-xml2js/releases)
- [Commits](Leonidas-from-XIV/node-xml2js@0.4.19...0.5.0)

Updates `aws-sdk` from 2.1282.0 to 2.1354.0
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](aws/aws-sdk-js@v2.1282.0...v2.1354.0)

---
updated-dependencies:
- dependency-name: xml2js
  dependency-type: indirect
- dependency-name: aws-sdk
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: make hsts header follow recommendation from csa (#6106)

* chore: make hsts header follow recommendation from csa

Description of check in csa scanner:
The scanner checks if your website offers HSTS. It checks for the existence of a "strict transport security header" with max-age >= 1yr, and the existence of "include subdomains" in your website’s response header.

* fix: fix test with new HSTS value

* chore: bump version to v6.41.0

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: Justyn Oh <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: tshuli <[email protected]>
Co-authored-by: Lin Huiqing <[email protected]>
Co-authored-by: Timothee Groleau <[email protected]>

* build: release v6.41.1 (#6134)

chore: bump version to 6.41.1

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: Foo Chi Fa <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: tshuli <[email protected]>
Co-authored-by: Lin Huiqing <[email protected]>
Co-authored-by: Timothee Groleau <[email protected]>
Co-authored-by: Ken Lee Shu Ming <[email protected]>
This was referenced Apr 19, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants