nodejs: Upgrade / 302 redirect `http` to `https` about serverless-dns HOT 8 OPEN

But I am confused how Cloudflare is inserting these headers, as max even has a different NS!

NS in general has no bearing on TLS certificate issuance. It is just that the ACME protocol ties in TLS with NS. CDNs usually vend certs via ALPN challenges.

Cloudflare "controls" the rethinkdns.com TLD, and can issue certs for all its immediate subdomains, *.rethinkdns.com, which they do (or Workers and Pages wouldn't work over HTTPS).

from serverless-dns.

If everything looks good, it may be set to 6 months as recommended or 1 year?

1yr sounds good to me.

from serverless-dns.

Yikes. Better yet, set HSTS (despite its shortcomings): https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

For TLD rethinkdns.com HSTS can be enabled from the Cloudflare dashboard.

from serverless-dns.

@ignoramous Have enabled HSTS on rethinkdns.com and subdomains.

It works! For http://max.rethinkdns.com, response is:

HTTP/1.1 307 Internal Redirect
Location: https://max.rethinkdns.com/
Non-Authoritative-Reason: HSTS

(In the browser only; not via curl, though)

But I am confused how Cloudflare is inserting these headers, as max even has a different NS!

Have set max-age: 1 month (needed for subdomains). If everything looks good, it may be set to 6 months as recommended or 1 year?

from serverless-dns.

Have set max-age to 1 year.

from serverless-dns.

@ignoramous

HSTS redirect to https from http only works when browser knows of HSTS on the domain.

To Reproduce, try opening http://max.rethinkdns.com/ from Incognito Window in Chrome, no redirects to https happen. But once you open https://max.rethinkdns.com/, redirects start working again.

I guess these Response headers come from browser itself:

HTTP/1.1 307 Internal Redirect
Location: https://max.rethinkdns.com/
Non-Authoritative-Reason: HSTS

Maybe HSTS Preload also needs to be enabled? https://hstspreload.org/?domain=rethinkdns.com

from serverless-dns.

Preload lists are the achilles-heel of HSTS.

HSTS could be used in addition to the 3xx redirect? I am not sure:

1. If DoH clients ever use non HTTPS endpoints.
2. If DoH clients ever follow HTTP redirects.

from serverless-dns.

@ignoramous
No, DoH clients weren't my concern.

https upgrade is needed for when someone would paste in a DoT hostname like 1-EAABAAA.max.rethinkdns.com in the browser and by default (in most browsers), it would try to connect over http. That's how I noticed this problem.

from serverless-dns.