Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Tracker marks domain as failing if it encounters a READ_TIMEOUT #6089

Open
adam2 opened this issue Jan 29, 2025 · 0 comments
Open

Tracker marks domain as failing if it encounters a READ_TIMEOUT #6089

adam2 opened this issue Jan 29, 2025 · 0 comments
Labels
bug Something isn't working

Comments

@adam2
Copy link

adam2 commented Jan 29, 2025

Describe the bug
When the Tracker encounters a READ_TIMEOUT error when scanning a domain it marks the domain as failing HTTPS, HSTS, Certificates, Protocols, Ciphers and Curves. This lowers the compliance summaries for an organization. READ_TIMEOUTs occur naturally on the internet. They reflect a general communications error between the Tracker server, its hosting network and the target network/domain. They do not indicate that the domain is not properly configured. In most cases, it is normal to retry a connection after a READ_TIMEOUT, up to a maximum number of times. It should not fail after the first READ_TIMEOUT. If after retrying a few times it still gets a READ_TIMEOUT it makes more sense to me to mark the untestable properties as unknown/information instead of failed.

Doing a manual rescan will generally correct the domain issues, but it does not increase the compliance summaries. Given the regular number of timeouts I am seeing in the tracker, I think this more likely points to a server/network issue with the tracker itself, but it appears on the site that our compliance is dropping.

To Reproduce
Steps to reproduce the behavior:

  1. Login to the Tracker
  2. Go to the Domains section
  3. Add a filter for HTTPS + EQUALS + FAIL
  4. Notice the domains that are failing
  5. Find a domain that was previously passing
  6. Click on the View Results button for that domain
  7. Notice the errors all stem from a READ_TIMEOUT error in the Tracker.
  8. Notice the Protocols, Cipher Suites, Curves, Certificate Chain sections are all blank and marked as Failed.

Expected behavior
A READ_TIMEOUT error on the Tracker side should not mark the domain as failing.

Screenshots

Image

Image

After a manual rescan

Image

Desktop (please complete the following information):

  • OS: Windows 11
  • Browser Mozilla Firefox
  • Version 134.0.2

Additional context
The Summaries tab of the Organization page does not update after a domain rescan. So it regularly shows a lower compliance score caused by READ_TIMEOUTs on the Tracker side.

@adam2 adam2 added the bug Something isn't working label Jan 29, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant