incorrect hsts handling with http

[Kevin Fenzi]

Midori doesn't seem to behave right handling HSTS sites.

Go to:

http://nathaniel.themccallums.org/2013/02/18/migrating-the-blog-to-openshift/

This will have:

Strict-Transport-Security:

header.

However, since it's over http, it SHOULD NOT honor it.
See:
http://tools.ietf.org/html/rfc6797
section 8.1

Instead it does honor it and loads the https site.

Gtklauncher, arora and epiphany all show the http site, so this looks like a bug in midori and not webkitgtk.

[Kevin Fenzi (kevin-launchpad)]

To clarify, it MUST NOT honor the header. (not a SHOULD NOT, but a MUST NOT).

[gue5t gue5t (gue5t)]

Do you know of a site on which to reproduce this? I can't do so at the given address but curl does not show the header you mention. If this is reproducible it should definitely be fixed.

[Launchpad Janitor (janitor)]

[Expired for Midori because there has been no activity for 60 days.]

[Kevin Fenzi (kevin-launchpad)]

Sorry, I didn't see your query for another domain...

How about:

http://kojipkgs.fedoraproject.org//work/tasks/7090/9447090/

That sends: "Strict-Transport-Security: max-age=15768000; includeSubDomains; preload"

With firefox or another browser that supports HSTS correctly, all further access to that site uses https.
Midori doesn't.