63097 2011-06-21 15:18:41 -0700 bugs.webkit.org should use Strict-Transport-Security 2011-06-21 18:05:10 -0700 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 abarth abarth aroben cevans eric webkit.review.bot wsiegrist oldest_to_newest 424784 0 abarth 2011-06-21 15:18:41 -0700 bugs.webkit.org should use Strict-Transport-Security 424785 1 98062 abarth 2011-06-21 15:19:52 -0700 Created attachment 98062 Patch 424786 2 98062 abarth 2011-06-21 15:20:34 -0700 Comment on attachment 98062 Patch My Apache is somewhat rusty, so patch is somewhat of a guess. 424788 3 eric 2011-06-21 15:25:02 -0700 SGTM. 424789 4 eric 2011-06-21 15:25:02 -0700 SGTM. 424793 5 cevans 2011-06-21 15:28:51 -0700 What about ;includeSubDomains (or however it is spelled) It defends against some additional faults in corner cases. Does this cover the attachment origins too? (e.g. https://bug-63097-attachments.webkit.org/) 424809 6 abarth 2011-06-21 15:40:51 -0700 > What about ;includeSubDomains (or however it is spelled) > It defends against some additional faults in corner cases. Looks like bugzilla only uses host cookies, so we probably don't need this. (It's not useful for integrity unless we can get all of webkit.org, which seems unlikely.) > Does this cover the attachment origins too? (e.g. https://bug-63097-attachments.webkit.org/) I believe so, but wms would know better than I. 424929 7 98062 webkit.review.bot 2011-06-21 18:05:06 -0700 Comment on attachment 98062 Patch Clearing flags on attachment: 98062 Committed r89399: <http://trac.webkit.org/changeset/89399> 424930 8 webkit.review.bot 2011-06-21 18:05:10 -0700 All reviewed patches have been landed. Closing bug. 98062 2011-06-21 15:19:52 -0700 2011-06-21 18:05:06 -0700 Patch bug-63097-20110621151951.patch text/plain 1150 abarth SW5kZXg6IFdlYnNpdGVzL2J1Z3Mud2Via2l0Lm9yZy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0g V2Vic2l0ZXMvYnVncy53ZWJraXQub3JnL0NoYW5nZUxvZwkocmV2aXNpb24gODkzODQpCisrKyBX ZWJzaXRlcy9idWdzLndlYmtpdC5vcmcvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMg KzEsMTUgQEAKKzIwMTEtMDYtMjEgIEFkYW0gQmFydGggIDxhYmFydGhAd2Via2l0Lm9yZz4KKwor ICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBidWdzLndlYmtp dC5vcmcgc2hvdWxkIHVzZSBTdHJpY3QtVHJhbnNwb3J0LVNlY3VyaXR5CisgICAgICAgIGh0dHBz Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD02MzA5NworCisgICAgICAgIFN0cmlj dC1UcmFuc3BvcnQtU2VjdXJpdHkgZm9yY2VzIGFsbCBjb25uZWN0aW9ucyB0byBidWdzLndlYmtp dC5vcmcgdG8KKyAgICAgICAgdXNlIEhUVFBTLCBwcmV2ZW50aW5nIHNzbHN0cmlwIGFuZCBvdGhl ciBhdHRhY2tzLgorCisgICAgICAgICogLmh0YWNjZXNzOgorCiAyMDExLTA1LTA0ICBDYWlvIE1h cmNlbG8gZGUgT2xpdmVpcmEgRmlsaG8gIDxjYWlvLm9saXZlaXJhQG9wZW5ib3NzYS5vcmc+CiAK ICAgICAgICAgUmV2aWV3ZWQgYnkgQWRhbSBSb2Jlbi4KSW5kZXg6IFdlYnNpdGVzL2J1Z3Mud2Vi a2l0Lm9yZy8uaHRhY2Nlc3MKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2Vic2l0ZXMvYnVncy53ZWJraXQub3Jn Ly5odGFjY2VzcwkocmV2aXNpb24gODkzMjQpCisrKyBXZWJzaXRlcy9idWdzLndlYmtpdC5vcmcv Lmh0YWNjZXNzCSh3b3JraW5nIGNvcHkpCkBAIC01LDMgKzUsNiBAQAogPEZpbGVzTWF0Y2ggXihs b2NhbGNvbmZpZy5qc3xsb2NhbGNvbmZpZy5yZGYpJD4KICAgYWxsb3cgZnJvbSBhbGwKIDwvRmls ZXNNYXRjaD4KKworIyBGb3JjZSBhbGwgY29ubmVjdGlvbnMgdG8gSFRUUFMgZm9yIDkwIGRheXMg YXQgYSB0aW1lLgorSGVhZGVyIHNldCBTdHJpY3QtVHJhbnNwb3J0LVNlY3VyaXR5ICJtYXgtYWdl PTc3NzYwMDAiCg==