Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clarify 13.1.8 to resolve #2416 #2529

Merged
merged 2 commits into from
Jan 16, 2025
Merged

Clarify 13.1.8 to resolve #2416 #2529

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1a83a06
Clarify 13.1.8 to resolve #2416
tghosth Jan 16, 2025
9531942
Merge branch 'master' into 2416-dont-redirect-to-https-for-api
elarlang Jan 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion 5.0/en/0x21-V13-API.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ This is a placeholder for future documentation requirements.
| **13.1.5** | [DELETED, INSUFFICIENT IMPACT] | | | | |
| **13.1.6** | [MODIFIED, MOVED FROM 13.2.6, COVERS 13.3.2, LEVEL L2 > L3] Verify that per-message digital signatures are used to provide additional assurance on top of transport protections for requests or transactions which are highly sensitive or which traverse a number of systems. | | | ✓ | 345 |
| **13.1.7** | [MODIFIED, MOVED FROM 14.4.1, COVERS 5.3.2] Verify that every HTTP response with a message body contains a Content-Type header field that matches the actual content of the response, including the charset parameter to specify safe character encoding (e.g., UTF-8, ISO-8859-1) according to IANA Media Types, such as "text/", "/+xml" and "/xml". | ✓ | ✓ | ✓ | 173 |
| **13.1.8** | [ADDED] Verify that HTTPS-based endpoints either return an error or do not respond to unencrypted HTTP requests which contain sensitive data in the headers or body. If a client is erroneously sending unencrypted HTTP requests but the requests are being automatically redirected to HTTPS, this leakage of sensitive data may go undiscovered. | | ✓ | ✓ | |
| **13.1.8** | [ADDED] Verify that only user-facing endpoints (intended for manual web-browser access) automatically redirect from HTTP to HTTPS, while other services or endpoints do not implement transparent redirects. This is to avoid a situation where a client is erroneously sending unencrypted HTTP requests but, since the requests are being automatically redirected to HTTPS, the leakage of sensitive data goes undiscovered. | | ✓ | ✓ | |

## V13.2 Web Services

Expand Down
Loading