hstspreload | Go package to scan sites | Proxy library

by chromium Go Version: Current License: BSD-3-Clause

X-Ray Key Features Code Snippets Community Discussions(4)Vulnerabilities Install Support

kandi X-RAY | hstspreload Summary

hstspreload is a Go library typically used in Networking, Proxy applications. hstspreload has no bugs, it has no vulnerabilities, it has a Permissive License and it has low support. You can download it from GitHub.

A Go package to scan sites against requirements for Chromium-maintained HSTS preload list.

Support

Quality

Security

License

Reuse

Support

hstspreload has a low active ecosystem.

It has 99 star(s) with 38 fork(s). There are 28 watchers for this library.

It had no major release in the last 6 months.

There are 15 open issues and 85 have been closed. On average issues are closed in 114 days. There are 4 open pull requests and 0 closed requests.

It has a neutral sentiment in the developer community.

The latest version of hstspreload is current.

Quality

hstspreload has 0 bugs and 0 code smells.

Security

hstspreload has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

hstspreload code analysis shows 0 unresolved vulnerabilities.

There are 0 security hotspots that need review.

License

hstspreload is licensed under the BSD-3-Clause License. This license is Permissive.

Permissive licenses have the least restrictions, and you can use them in most projects.

Reuse

hstspreload releases are not available. You will need to build from source code and install.

Installation instructions are not available. Examples and code snippets are available.

It has 2808 lines of code, 104 functions and 18 files.

It has high code complexity. Code complexity directly impacts maintainability of the code.

Top functions reviewed by kandi - BETA

kandi has reviewed hstspreload and discovered the below as its top functions. This is intended to give you an instant insight into hstspreload implemented functionality, and help decide if they suit your requirements.

main scans hstspreload .
ParseHeaderString parses a header string into a HSTeader .
preloadableHTTPRedirectsURL checks if the first redirects on the first redirect .
PreloadableDomainResponse is used to preload a response for a given domain response . It returns a response and an error if any .
preloadableHeaderMaxAge checks that the given HSTeadm has the maximum age .
checkDomainFormat checks the validity of a domain string .
checkWWW verifies that the provided host is a valid FTP server .
printHelp prints help for HSTSP .
getResponse gets the HTTP response for the given domain .
Match returns true if the given issues are the same .

Get all kandi verified functions for this library.

hstspreload Key Features

No Key Features are available at this moment for hstspreload.

hstspreload Examples and Code Snippets

No Code Snippets are available at this moment for hstspreload.

Community Discussions

Trending Discussions on hstspreload

HSTS preload Meaning

Errors when checking eligibility for HSTS preload

SOLVED - Installing nextcloud on nginx, getting error 500

"sanic tried to use loop.add_signal_handler but it is not implemented on this platform" windows 10

QUESTION

HSTS preload Meaning

Asked 2022-Mar-07 at 18:45

In MDN HTTP Strict Transport Security (HSTS), it has an example of HSTS settings as below

...

ANSWER

Answered 2022-Mar-07 at 18:45

Preload is a big commitment. It will effectively be hardcoded into a browser’s code. Given it takes several months at a minimum to roll out new version, it’s basically irreversible.

Also as it’s down at the domain level, mistakes have been made. For example preloading domain.com but covering that blog.domain.com, or intranet.domain.com have not been upgraded to HTTPS. At this point your options are 1) upgrade side to HTTPS and live with zero users to the site until the or 2) reverse the preload and wait the months for that to roll out to all browsers and deal with zero users until then.

HTTPS is much more common now, so the risks are reduced but when HSTS preload first came out, these were real risks.

Therefore the preload attribute was a signal that the site owner was ready for that commitment. It also prevent someone else submitting a site that wasn’t using this header (whether maliciously or with good, but misguided, intentions).

You are correct in that it doesn’t “do” anything in the browser.

There was also talk of checking if the preload header was still being sent, and if not removing the preload but not sure if that’s done.

Source https://stackoverflow.com/questions/71377849

QUESTION

Errors when checking eligibility for HSTS preload

Asked 2021-Jun-28 at 11:46

I have this website set up: http://website1.com/ - returns 301 Moved Permanently and redirects to http://www.website1.com/.

http://www.website1.com/ - returns 301 Moved Permanently and redirects to https://www.website2.com/.

https://www.website2.com/ - returns 200 OK and has this in the response:

strict-transport-security: max-age=31536000; includeSubDomains

I have this subdomain running a web app: https://subdomain.website1.com/ This also has the following header in the response:

Strict-Transport-Security: max-age=31536000; includeSubDomains

I want to have preload functionality for all sub domains of website1.com/. However, I get the following errors when checking eligibility:

...

ANSWER

Answered 2021-Jun-28 at 11:46

I have this website set up: http://website1.com/ - returns 301 Moved Permanently and redirects to http://www.website1.com/.

This is your issue. http://website1.com should redirect to https://website1.com then on to https://www.website1.com.

This way the top level website1.com domain will pick up the HSTS header and protect itself and all sub domains (assuming it has includeSubDomains attribute set - which is a pre-requisite for preloading).

Without switching to HTTPS first, or if you skip straight to https://www.website1.com then the browser will never see the HSTS header on the top level domain and so know that it (and all sub domains) should be protected by HSTS. This is 1) less secure and 2) more risky when preloading as maybe you still have a non-HTTPS site (e.g. http://blog.website1.com or http://intranet.website1.com). By forcing you to set this up before you preload it, will hopefully surface those issues, when it’s still possible to reverse HSTS (which is basically impossible after its preloaded into browser’s source code - at least for many months anyway).

And the risk of accidentally locking out a non-HTTPS subdomain with preload is one reason I’ve argued in the past that preload is potentially more risky than useful, and overkill for most sites. But with HTTPS becoming the norm, I’m less against it now. Still think it’s a bit overkill except for high target sites though.

Btw for the first error, make sure HSTS header is included on 301 redirects. For Apache for example you need always set rather than just set as explained here: https://stackoverflow.com/a/48103216/2144578

Source https://stackoverflow.com/questions/68148666

QUESTION

SOLVED - Installing nextcloud on nginx, getting error 500

Asked 2020-Apr-27 at 15:05

I'm following the instructions to install Nextcloud on an nginx server. I copy the configuration from the offical documentation, i set my server name and my ssl certificate path, and when i try to reach nextcloud from my browser i get

"500 Internal server error".

When i check in the error.log i get

rewrite or internal redirection cycle while processing "/index.php"

This is my configuration file:

...

ANSWER

Answered 2020-Apr-27 at 15:05

I solved the issue by re-uploading the configuration file via ftp, pasting it in nano on the ssh shell was a bad idea!

Source https://stackoverflow.com/questions/61448437

QUESTION

"sanic tried to use loop.add_signal_handler but it is not implemented on this platform" windows 10

Asked 2020-Apr-02 at 10:06

I am trying to run the basic sanic app on windows 10.

...

ANSWER

Answered 2020-Apr-02 at 10:06

Need to install sanic from git.

Source https://stackoverflow.com/questions/60984806

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install hstspreload

You can download it from GitHub.

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: