From 66da30f06b9ac5ea886564fe555ddfebf9ddaec5 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Thu, 5 Dec 2024 21:15:07 +0200 Subject: [PATCH] Add no redirect to HTTPS to resolve #2416 (#2432) --- 5.0/en/0x21-V13-API.md | 1 + 1 file changed, 1 insertion(+) diff --git a/5.0/en/0x21-V13-API.md b/5.0/en/0x21-V13-API.md index 3bff45588d..a6626f77a8 100644 --- a/5.0/en/0x21-V13-API.md +++ b/5.0/en/0x21-V13-API.md @@ -21,6 +21,7 @@ This is a placeholder for future documentation requirements. | **13.1.5** | [DELETED, INSUFFICIENT IMPACT] | | | | | | **13.1.6** | [MODIFIED, MOVED FROM 13.2.6, LEVEL L2 > L3] Verify that per-message digital signatures are used to provide additional assurance on top of transport protections for requests or transactions which are highly sensitive or which traverse a number of systems. | | | ✓ | 345 | | **13.1.7** | [MODIFIED, MOVED FROM 14.4.1] Verify that every HTTP response with a message body contains a Content-Type header field that matches the actual content of the response, including the charset parameter to specify safe character encoding (e.g., UTF-8, ISO-8859-1) according to IANA Media Types, such as "text/", "/+xml" and "/xml". | ✓ | ✓ | ✓ | 173 | +| **13.1.8** | [ADDED] Verify that HTTPS-based endpoints will only respond to non-encrypted HTTP requests with an error or will not respond at all. Responding with an automatic redirect to the HTTPS endpoint may lead to clients accidentally sending data over non-encrypted HTTP, but this is not being discovered. | | ✓ | ✓ | | ## V13.2 Web Services