Skip to content

Evaluate Canonical value of security.txt ? #772

Closed
#959
Closed
Evaluate Canonical value of security.txt ?#772
#959
Assignees
mxsashabaknu
Labels
contentChange (needed) to the content repository alongside with this issue/PRcontent doneChanges to the content repository for this PR are doneenhancementIssues that suggest slight improvements to existing code, tests, etc.
Milestone
v1.8

Description

@baknu
baknu
opened on Oct 20, 2022

Currently we do not check the value of the Canonical fields, because we find that its meaning is unclear in the security.txt specification. The latter is only the case when redirects are involved.

This issue is to get more clearity on its meaning when redirects are invloved, and also to discuss if and how we can add a check for this.

Note 1: Clarification question was already asked on securitytxt/security-txt#217
Note 2: The sectxt parser now uses the following interpretation: ""Web URI where security.txt is located must match with a 'Canonical' field. In case of redirecting either the first or last web URI of the redirect chain must match.""

Activity

  1. baknu
    added
    enhancementIssues that suggest slight improvements to existing code, tests, etc.
    contentChange (needed) to the content repository alongside with this issue/PR
    on Oct 21, 2022
  2. baknu
    assigned
    mxsasha
    on Oct 21, 2022
  3. baknu
    added this to the v1.7 milestone on Oct 21, 2022

  4. WKobes commented on Jan 30, 2023

    @WKobes
    WKobes
    on Jan 30, 2023
    Collaborator

    For the Dutch government this could also identify incorrect redirects.

    E.g. https://www.rijksoverheid.nl/.well-known/security.txt would fail because the Canonical URL is https://www.ncsc.nl/.well-known/security.txt

  5. mxsasha
    modified the milestones: v1.7, v1.8 on Mar 7, 2023

  6. mxsasha commented on Apr 11, 2023

    @mxsasha
    mxsasha
    on Apr 11, 2023
    Collaborator

    If we finally want to do this, we first need to make a final decision on what we see as the requirements for Canonical. We've been pingponging on this for months now :)

  7. mxsasha commented on Apr 18, 2023

    @mxsasha
    mxsasha
    on Apr 18, 2023
    Collaborator

    Final decision:

    • If a (or multiple) Canonical field is present, regardless of signature, the last URL in the redirect chain must be listed in a Canonical field, including query string if present.
    • If the file is signed, one or more Canonical fields must be present - already tested.
  8. mxsasha
    added a commit that references this issue on Apr 26, 2023

    Fix #772 - Evaluate Canonical value of security.txt

    2be3553
  9. mxsasha
    linked a pull request that will close this issueTest Canonical in sectxt (#772) and update dep to 0.8.3 #959on Apr 26, 2023

  10. mxsasha commented on Apr 26, 2023

    @mxsasha
    mxsasha
    on Apr 26, 2023
    Collaborator

    #959 adds this and also updates the dependency to 0.8.3.

    @baknu we need new labels for errors no_canonical_match, no_csaf_file and multiple_csaf_fields and probably need to update the test description.

    As before, DTC's wording does not have to match ours, we only use the same error code. Our interpretation of no_canonical_match is different from DTC, so we definitely should not reuse their error message text there. But I also think their proposed texts for CSAF are not very clear.

  11. mxsasha
    closed this as completedin #959on Apr 26, 2023
  12. mxsasha
    added a commit that references this issue on Apr 26, 2023

    Fix #772 - Evaluate Canonical value of security.txt

    f8358c4
  13. mxsasha
    reopened this on Apr 26, 2023

  14. 11 remaining items

  15. baknu commented on Oct 7, 2023

    @baknu
    baknu
    on Oct 7, 2023
    ContributorAuthor

    @mxsasha It seems better to wait and do this when we upgrade to the upcoming sectxt version 0.9.1 (see #1046). Right?

  16. baknu
    added
    questionIssues that involve a question
    on Oct 7, 2023
  17. baknu
    modified the milestones: v1.8, v1.9 on Oct 7, 2023

  18. mxsasha commented on Oct 9, 2023

    @mxsasha
    mxsasha
    on Oct 9, 2023
    Collaborator

    @mxsasha It seems better to wait and do this when we upgrade to the upcoming sectxt version 0.9.1 (see #1046). Right?

    The canonical check is already done. The code is merged, we are upgraded to 0.8.3 in #959 and the bug I mentioned on June 8th is fixed. Only content is pending, included in https://github.com/internetstandards/Internet.nl_content/pull/41

  19. baknu
    modified the milestones: v1.9, v1.8 on Oct 10, 2023

  20. baknu commented on Oct 11, 2023

    @baknu
    baknu
    on Oct 11, 2023
    ContributorAuthor

    @mxsasha: Content is ready. Could you check? Thanks.

  21. baknu
    added
    content doneChanges to the content repository for this PR are done
    and removed
    questionIssues that involve a question
    on Oct 11, 2023
  22. baknu
    assigned
    mxsasha
    on Oct 11, 2023
  23. baknu
    added
    questionIssues that involve a question
    on Oct 11, 2023
  24. baknu
    removed
    questionIssues that involve a question
    on Oct 26, 2023

  25. baknu commented on Oct 26, 2023

    @baknu
    baknu
    on Oct 26, 2023
    ContributorAuthor

    Processed feedback from @mxsasha

  26. baknu
    closed this as completedon Oct 26, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

contentChange (needed) to the content repository alongside with this issue/PRcontent doneChanges to the content repository for this PR are doneenhancementIssues that suggest slight improvements to existing code, tests, etc.

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions