Security (critical): plain HTTP served without redirecting to HTTPS issue #218 closed: completed andymccall opened this · 1 comment
andymccall set labels security, bug ·
andymccall
Cloudflare Always Use HTTPS and Automatic HTTPS Rewrites are on (2026-10-15): http://oxygenhub.io/login and a POST to it now answer 301 to https. Still to do in the hub: refuse or redirect plain http itself (so any other path in is covered), Secure cookies, regression tests, then HSTS.
closed by change 9a8e3b4419e0 ·
External security review, 2026-10-15: http://oxygenhub.io/ and /login answer 200 and a POST over HTTP is accepted. Cloudflare Always Use HTTPS (Andy, now). In the hub: redirect to the https base_url whenever the request arrived over http (X-Forwarded-Proto / CF-Visitor from the tunnel, or a plain http listener in production), never serve a form or take a session cookie over http; cookies Secure; regression tests; then Strict-Transport-Security (short max-age first, includeSubDomains once every subdomain is https).