-
Notifications
You must be signed in to change notification settings - Fork 14
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Do not serve potentially sensitive data over insecure protocol #13
Comments
Thank you for the report! All traffic to cla.js.foundation is now redirected to https. In order to implement HSTS, this will need proper review from someone on our infrastructure team as it will impact more than one site. As the team are all volunteers, please be patient and we will hopefully have these changes made soon. |
@JSFOwner Thanks! That was a very fast response. Yes, while HSTS (with |
Atm, I can observe my full name and my email (among other stuff) being transfered over an insecure protocol when I open http://cla.js.foundation/webpack/loader-runner.
In fact, it transfers the following stuff (over http://cla.js.foundation/api/github/call and http://cla.js.foundation/api/cla/getLastSignature):
While all of that is public info (at least for me), I do not want the places I visit (like coffee shops and whatever else) to be able to track me over that going through WiFi.
Please, do the following:
preload
feature.The text was updated successfully, but these errors were encountered: