mozilla/Garmr — pull request #11 by Prandium (2014-09-03 20:10:20+00:00)
Title: HSTS Fixes

On some sites, such as facebook.com, the HSTS header is only set when it gets a request from a browser that has implemented HSTS. Therefore, in order to perform a valid check, Garmr needs to set the User-Agent request header to be a modern web browser, such as the latest version of Firefox. I've set this value in the requests session.

I've also added 2 additional checks to the HSTS check to validate the max-age is long enough and to validate that the includeSubDomains directive is included. For information on why this is important, see the HSTS spec here: http://tools.ietf.org/html/rfc6797 and a proof of concept for SSL Strip with non-protected sites here: https://www.youtube.com/watch?v=uGBjxfizy48