Re: [HASMAT] wrt port numbers - comment 51 bug 495115 (bugzilla.mozilla.org)

[=JeffH <[e-mail]>]

Adam wrote:
 >
 > Another way of thinking about the situation is as follows:
 >
 > 1) An STS server is promising never to use HTTP or send broken certificates.
 >
 > 2) If we're trying to issue an HTTP request to example.com:8080, then
 > that's not what example.com wants and we shouldn't do it.

Adam's of course correct here.

Though, to pedantically fill in some of the blanks...

1) An HSTS server is promising never to use HTTP over insecure transport or to 
send a broken certificate (or fail to establish the secure connection without 
errors for whatever reason).

2. If we're trying to issue an HTTP request over insecure transport to 
example.com:8080, when we've previously established (by legit means) that /that 
host is an HSTS Server/, then that is not what example.com wants and we 
shouldn't do it.


 > With respect to port numbers, I think that's not well covered in the spec.

I agree, will try to rectify this in -03.


 > The way it works in chrome is that the STS state is for the whole host (this
 > is important to protect secure cookies, which are shared by the whole host).

Another way to say it is that the notion of a HSTS Server maps to a DNS Domain 
(aka host) name, regardless of port.


 >  For the redirect behavior: port numbers are preserved except port 80 is
 > changed to port 443 because 80 is the default port for http.

Hm, I wonder if that should be in the spec (I'm thinking yes offhand). It 
presently isn't and thus is perhaps a impl characteristic of Chrome only.


=JeffH