13 of 13
added 406 characters in body
Nick Craver
  • 125.1k
  • 25
  • 431
  • 571

Network-wide HTTPS: It's time

Update 2017-05-22

stackoverflow.com is now https://. I've written up a lot of what it took to get here in a blog post. Next up is chat and then https-only cookies. We'll be ramping up HSTS max-age directives as we go. I'll continue to update this post as we deploy new bits.

Update 2017-03-16

We've redirected all child meta traffic from meta.*.stackexchange.com to *.meta.stackexchange.com, and are now forcing HTTPS. We have also rebaked links inside the network (except comments) to point to the new domains and protocol. We'll get to comments at the end.

We are aware of HTTPS Everywhere users getting too many redirects here, and unfortunately the issue is with their ruleset. I have submitted a PR to resolve this here: EFForg/https-everywhere/#9110

We are pausing further migrations while we observe how google handles sites like Super User over the next week or so. I'll be back from vacation on March 27th and we plan to deploy Content-Security-Policy-Report-Only headers for reporting and proceed with full Q&A deployment across all main sites then.

Initial post

This is a heads up, and a request for help. Related: original post from our test site, Meta Stack Overflow.

HTTPS for our entire network is long overdue, but we've been working hard on it behind the scenes. Expect a pretty big blog post when we turn it on everywhere that details the journey.

There are a few lingering questions on HTTPS we're not confident in until we do it live. One of these is the Google site move in webmasters. It still (to our disbelief) treats HTTP and HTTPS as different properties. I have no idea why. And the "change of address" tool doesn't support such a move either:

Note: The tool does not currently support the following kinds of site moves: subdomain name changes, protocol changes (from HTTP to HTTPS), or path-only changes.

So we'll have to create property sets for every single site during the move to HTTPS. Fun!

Given the above, we need to see how all of this works in practice with real load:
We're starting with meta.stackoverflow.com and meta.stackexchange.com.

Here's an order of things that's been going on (per site):

  1. done Infrastructure in place:
    • A fast CDN/Proxy for local termination (Fastly)
    • Certificates (including IP pooling support to bridge HTTP/1.1 & HTTP/2)
    • Logging
  2. done Get third-party support in place:
    • All per-site scripts onto our CDN and served securely
    • Ad providers to HTTPS
  3. done Fix a ton of code that assumes http:// in a million places.
  4. done Prevent users from embedding new http:// content (e.g. forcing HTTPS images).
  5. done Cleanup all existing user content that was http:// (https:// where possible, and converted to links if we can't embed it securely).
  6. done Make sites render absolute URLs as https://.
  7. done Move canonical URLs to https://.
  8. done 301 Traffic to https:// for all.
  9. done (Child metas) Move from meta.*.stackexchange.com to *.meta.stackexchange.com.
  10. Force all Q&A traffic to https:// (and set an https-only cookie)
  11. Migrate all existing sessions to secure sessions (this will take time to run).
  12. Use HSTS to ensure browsers don't hit Q&A sites via http:// at all.

This is a really high level list, and there are a crazy number of nuances and edge cases to the above. This is for Q&A. Area 51, Chat, and stackexchange.com (the main site) have a separate set of concerns and code we'll address after Q&A. The list also isn't necessarily in order. While we're testing #6, Samo and I will be working on #11 at the same time.

But we have to do all of this across the network, and we're starting that process now. meta.stackoverflow.com was our testing ground this week. While we're still waiting for Google's analytics to catch up so we can assess impact, we're ready to go on a few more sites. Here's our rough list:

  1. done meta.stackoverflow.com
  2. done meta.stackexchange.com
  3. done security.stackexchange.com (why? This community is well equipped to test HTTPS concerns and give feedback)
  4. done meta.security.stackexchange.com (moving to security.meta.stackexchange.com)
  5. stackoverflow.com
  6. done Q&A network main sites except stackoverflow.com (e.g. *.stackexchange.com, superuser.com)
  7. done Stack Overflow localized child metas (e.g. meta.ja.stackoverflow.com moving to ja.meta.stackoverflow.com)
  8. done Q&A network child meta sites (e.g. meta.*.stackexchange.com)
  9. done stackexchange.com (the top level non-Q&A domain)
  10. done area51.stackexchange.com
  11. (Planning required) chat.stackoverflow.com, chat.stackexchange.com, and chat.meta.stackexchange.com

We want your help simply reporting any issues with insecure content on https:// or any other oddities you see. We'll try to address them as soon as possible. Since we get asked this a lot, yes - I'll write an exhaustive blog post about everything we hit along the way when we're finished here.

Nick Craver
  • 125.1k
  • 25
  • 431
  • 571