Skip to content

Conversation

@birgelee
Copy link
Member

@birgelee birgelee commented Feb 3, 2025

Added integration for contact email as well as bad port redirects that violate:

Redirects MUST be initiated at the HTTP protocol layer.
a. For validations performed on or after July 1, 2021, redirects MUST be the result
of a 301, 302, or 307 HTTP status code response, as defined in RFC 7231, Section
6.4, or a 308 HTTP status code response, as defined in RFC 7538, Section 3.
Redirects MUST be to the final value of the Location HTTP response header, as
defined in RFC 7231, Section 7.1.2.
b. For validations performed prior to July 1, 2021, redirects MUST be the result of
an HTTP status code result within the 3xx Redirection class of status codes, as
defined in RFC 7231, Section 6.4. CAs SHOULD limit the accepted status codes
and resource URLs to those defined within 1.a.
2. Redirects MUST be to resource URLs with either the “http” or “https” scheme.
3. Redirects MUST be to resource URLs accessed via Authorized Ports

Point 3 is currently tested. Point 2 I expect is implicitly handled since the URL is in an HTTP library. I may try some crazy 3xx codes later, but I would expect the library to be strict about what codes it accepts (hopefully).

Note, these integration tests for "Redirects MUST be to resource URLs accessed via Authorized Ports" currently fail because we do not enforce the port constraint on the http library.

@birgelee
Copy link
Member Author

birgelee commented Mar 8, 2025

These integration tests are now in https://github.com/open-mpic/open-mpic-api-compliance . This branch has diverged from main and the issues identified have been fixed. Closing.

@birgelee birgelee closed this Mar 8, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant