Skip to content

Fixed HSTS policy application

username-removed-267665 requested to merge gh-36a47cc5/34/juaristi/hsts-fix-translation into gl-36a47cc5/34/rockdaboot/wget2

Created by: juaristi

I don't know if I'm missing something, but from my tests, HSTS policies didn't seem to be applied.

Before the patch (latest git):

$ src/wget2 --delete-after http://www.airbnb.es
[0] Downloading 'http://www.airbnb.es' ...
HTTP response 301 Moved Permanently
[0] Downloading 'https://www.airbnb.es/' ...
WARNING: OCSP is not available in this version of GnuTLS.
HTTP response 200 OK

After the patch:

$ src/wget2 --delete-after http://www.airbnb.es
[0] Downloading 'http://www.airbnb.es' ...
HSTS in effect for www.airbnb.es:80
WARNING: OCSP is not available in this version of GnuTLS.
HTTP response 200 OK

I've effectively checked how after my patch, the website was loaded directly through HTTPS. All the tests were performed with an already existing ~/.wget_hsts for www.airbnb.es.

Merge request reports