Do not serve potentially sensitive data over insecure protocol

[ChALkeR]

Atm, I can observe my full name and my email (among other stuff) being transfered over an insecure protocol when I open http://cla.js.foundation/webpack/loader-runner.

In fact, it transfers the following stuff (over http://cla.js.foundation/api/github/call and http://cla.js.foundation/api/cla/getLastSignature):

• My full name
• My email
• My GitHub handle
• My Twitter handle
• My home city

While all of that is public info (at least for me), I do not want the places I visit (like coffee shops and whatever else) to be able to track me over that going through WiFi.

Please, do the following:

• Disable http, make http redirect to https
• Enable HSTS, with preload feature.
• Ensure that the website has HSTS preloaded over https://hstspreload.org/

[JSFOwner]

Thank you for the report! All traffic to cla.js.foundation is now redirected to https. In order to implement HSTS, this will need proper review from someone on our infrastructure team as it will impact more than one site. As the team are all volunteers, please be patient and we will hopefully have these changes made soon.

[ChALkeR]

@JSFOwner Thanks! That was a very fast response.

Yes, while HSTS (with preload) is needed so that no one would be able to fake the cla.js.foundation page and trick users into entering data to it / performing actions from it, not replying with user data over http protocol fixes the usecase that I described in the orignal post.