{"action":"created","issue":{"url":"https://api.github.com/repos/18F/pulse/issues/170","labels_url":"https://api.github.com/repos/18F/pulse/issues/170/labels{/name}","comments_url":"https://api.github.com/repos/18F/pulse/issues/170/comments","events_url":"https://api.github.com/repos/18F/pulse/issues/170/events","html_url":"https://github.com/18F/pulse/pull/170","id":82882087,"number":170,"title":"Allow redirector domains to \"Enforce HTTPS\" as long as they redirect to HTTPS somewhere immediately","user":{"login":"konklone","id":4592,"avatar_url":"https://avatars.githubusercontent.com/u/4592?v=3","gravatar_id":"","url":"https://api.github.com/users/konklone","html_url":"https://github.com/konklone","followers_url":"https://api.github.com/users/konklone/followers","following_url":"https://api.github.com/users/konklone/following{/other_user}","gists_url":"https://api.github.com/users/konklone/gists{/gist_id}","starred_url":"https://api.github.com/users/konklone/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/konklone/subscriptions","organizations_url":"https://api.github.com/users/konklone/orgs","repos_url":"https://api.github.com/users/konklone/repos","events_url":"https://api.github.com/users/konklone/events{/privacy}","received_events_url":"https://api.github.com/users/konklone/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-05-30T18:40:37Z","updated_at":"2015-06-01T03:41:45Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/18F/pulse/pulls/170","html_url":"https://github.com/18F/pulse/pull/170","diff_url":"https://github.com/18F/pulse/pull/170.diff","patch_url":"https://github.com/18F/pulse/pull/170.patch"},"body":"This credits \"redirect domains\" that always _immediately_ redirect to an HTTPS URL (even if it's another domain's URL) as \"Enforcing HTTPS\". \r\n\r\nFor example, the HTTP endpoints for `18f.gov` and `wh.gov` both always redirect to an HTTPS URL, rather than first redirecting internally. There's no good security reason for the domains to first redirect internally before redirecting externally (it doesn't increase or decrease attack surface for the user), so they should be credited as enforcing HTTPS. They still have the same obligation to add HSTS as everyone else. (And in `18f.gov` and `wh.gov`'s case, they do.)\r\n\r\nThis affects 8 domains: `nic.gov`, `wh.gov`, `18f.gov`, `bfelob.gov`, `nationalresourcedirectory.gov`, `myra.gov`, `fedbizopps.gov`, and `earmarks.gov`.\r\n\r\nThis is downstream of #169, which should be merged first."},"comment":{"url":"https://api.github.com/repos/18F/pulse/issues/comments/107298740","html_url":"https://github.com/18F/pulse/pull/170#issuecomment-107298740","issue_url":"https://api.github.com/repos/18F/pulse/issues/170","id":107298740,"user":{"login":"juliaelman","id":955558,"avatar_url":"https://avatars.githubusercontent.com/u/955558?v=3","gravatar_id":"","url":"https://api.github.com/users/juliaelman","html_url":"https://github.com/juliaelman","followers_url":"https://api.github.com/users/juliaelman/followers","following_url":"https://api.github.com/users/juliaelman/following{/other_user}","gists_url":"https://api.github.com/users/juliaelman/gists{/gist_id}","starred_url":"https://api.github.com/users/juliaelman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/juliaelman/subscriptions","organizations_url":"https://api.github.com/users/juliaelman/orgs","repos_url":"https://api.github.com/users/juliaelman/repos","events_url":"https://api.github.com/users/juliaelman/events{/privacy}","received_events_url":"https://api.github.com/users/juliaelman/received_events","type":"User","site_admin":false},"created_at":"2015-06-01T03:41:45Z","updated_at":"2015-06-01T03:41:45Z","body":"+1 "}}