mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
hsts grading was gated on the scheme of the originally requested url, but the client follows redirects, so an http target that redirects to https skipped the hsts check entirely and dropped a high-severity finding. decide the scheme from the final response request url instead, falling back to the requested url only when no response request is set.