GitHub Community
HSTS (and other security headers) for GitHub Pages with custom domains #4444
|
What it says on the tin. Would be nice to be able to send HSTS (and other security headers) for sites on custom domains hosted by GitHub Pages. An immediate failure for the Security category is encountered when using scanners like webpagetest.org, etc. Seems to have something to do with the age of my account. There was an issue for this on the old "github" repo, but it doesn't look like it had been revived as a discussion here since.
Edit: Looks like the other request has vanished. |
Replies: 6 comments 20 replies
|
As a note, a major thread preceding this 1 is isaacs/github#1249. |
|
Yep, started there. 😄 |
|
This is the only thing stopping me moving hosting my tiny blog and project sites from self-hosted to Pages. |
|
This year is the year. |
|
For suck's sake Microsoft, we need safe Github pages. Start implementing proper support for .htaccess files |
|
@Rabadash8820 Care to discuss why not? |
|
@tvdijen I downvoted your tone, not your request |
|
Get a grip! The way they're dealing with this is a big joke.. What ever happened to 'security by design'? |
|
There seems to be a development in this direction (not configurable, at least yet): % fetch -o - -vv https://group.miletic.net/ | & grep Security
<<< Strict-Transport-Security: max-age=31556952 |
|
Not seeing that on my own domain, |
|
Same for me, no |
|
@MatTheCat my account wasn't, but the organization indeed was. That's good to know. |
|
2024, any update here? Simply add the header to the response 🤷 |
|
But how old is the account/org the repo is owned by? |
|
Yes, the account is also created a few months ago (end of 2023). |
|
Interesting. No idea, then. 🤷 |
|
Oh well, I have bugs reported to Microsoft 2yrs ago that still haven't been fixed.. It's ridiculous, but we kind of have to deal with them... |
|
As I first saw in https://github.com/orgs/community/discussions/113716#discussioncomment-12344699 and recently confirmed myself, you can contact GitHub Support, and they can manually add the HSTS header to sites of your choosing. |
As I first saw in https://github.com/orgs/community/discussions/113716#discussioncomment-12344699 and recently confirmed myself, you can contact GitHub Support, and they can manually add the HSTS header to sites of your choosing.