HTTP redirects to HTTPS

http-to-https-redirectDeterministic

Plain HTTP requests are redirected to HTTPS, never answered with content.

v1.0.2 · current

Version 1.0.2

Implementation sha256 Published CWE-319

Verifies: Plain-HTTP requests to the deployed origin are redirected to https and never answered with content.
Inputs: Plain http:// requests to the root and up to five application paths found in the code of the checkout, through the engine's outbound helper, when the repository declares a deployed origin. Reverse proxy and framework configuration files of the checkout. Paths listed in excludes (test, spec and tmp files, __tests__, __mocks__, fixtures, test, tests and audit-scripts folders) are never analysed.
Decision rule: Not applicable without a deployed origin, without the outbound helper, or when the origin does not answer plain HTTP at all. FAIL when any probed path answers 2xx over plain HTTP or redirects to a non-https location (HIGH). An explicit redirect disable or a port-80 server block without a redirect in the checkout is MEDIUM (blocks in Extended suites). PASS when every answered plain-HTTP request was a redirect to https.
Type: deterministic

1.0.2: never analyses temporary files (*.tmp.*; spec.excludes follows AUDITOR_ANALYSIS_EXCLUDES). (1.0.1: never analyses test, spec, fixture and mock paths nor the auditor's own scripts (spec.excludes = AUDITOR_ANALYSIS_EXCLUDES); a fixture-looking secret (sk_test_, example, dummy) in real code is LOW, informative; every model call stays under the engine prompt cap (spec.promptMaxChars = AUDITOR_AI_PROMPT_MAX_CHARS): assess mode sends the candidate set in parts and aggregates the verdicts (a HIGH in any part is a FAIL, an unsatisfied part is a FAIL).)

for (const p of paths) { const res = await origin.fetch(`http://${host}${p}`); // redirect: 'manual'

// 3xx + Location https:// -> ok; 2xx -> FAIL (content over HTTP); 3xx elsewhere -> FAIL; refused -> not served }

// no deployed origin -> not applicable

The full script is disclosed on request in a read-only viewer (never published on GitHub); the attestation binds to this exact hash.