This may require some research. * Are we using a CDN? * Does IT have any objections? * Are there any cache policies that need to change? There are two parts to this: 1) make http redirect to https (this is on Ops). 2) add STS middleware/headers. There are two related Firefox changes. a) Bug 840737 - Switch in-product URLs to HTTPS. We should let this happen first. b) (Not filed yet) get on the HSTS preload list (no Firefox will ever request HTTP again!)

Derp, sorry, that's bug 840678.

In order to do b), You need to start sending the Strict-Transport-Security header. We only put sites on the preloaded list if they are sending that header with an expiration time of more than 18 weeks.

(In reply to Brian Smith (:bsmith) from comment #2) > In order to do b), You need to start sending the Strict-Transport-Security > header. We only put sites on the preloaded list if they are sending that > header with an expiration time of more than 18 weeks. (In reply to James Socol [:jsocol, :james] from comment #0) > 2) add STS middleware/headers. Yep!

Putting these in my queue for this quarter.

Pretty sure we can't do this now because we have to support http://m.input.mozilla.org/ for a couple more Firefox for Android versions. Pushing this out of my queue for now.

I'm pretty sure we're still waiting on things. Going to bump this out of the sprints.

The Input service has been decommissioned (see bug 1315316) and has been replaced by a redirect to an external vendor (SurveyGizmo). I'm bulk WONTFIXing Input bugs that do not appear to be relevant anymore.