For Apache, prefer 308 Permanent Redirect to 301 Moved Permanently

[mavit]

Applies to the modern configuration only.

Relates to #117.

[gstrauss]

lighttpd mod_redirect in lighttpd 1.4.75 and later takes a more nuanced approach by default and uses 301 Moved Permanently for all GET/HEAD requests or for HTTP/1.0 requests with other HTTP methods. For HTTP/1.1 or later, lighttpd mod_redirect uses 308 Permanent Redirect for HTTP methods which are not GET/HEAD.

The Hypertext Transfer Protocol Status Code 308 (Permanent Redirect) https://www.rfc-editor.org/rfc/rfc7238
was published June 2014, over 10 years ago.

For redirection involving HSTS, all clear-text http requests are redirected unconditionally to https.

Absent HTTP version support similar to what is in lighttpd 1.4.75, 308 Permanent Redirect should be used for all HSTS redirects, as that is the proper behavior for methods which are not GET/HEAD. If a small number of end-users encounter problems with this recommended setting with specific old clients, then that small number of end-users can adjust the configs to use 301 instead of 308, and trade-off HSTS redirecting all HTTP methods other than GET/HEAD to HTTP GET method to the https location.

[gstrauss]

@janbrasna you added a label that this change is blocked by the spec. I understand that the implementation in this PR modifies the guidelines to add the permanent redirect code to the spec, but I do not think we should implement it that way.

If, in the future, we generate older versions of the site, we should do so from source control, or source control snapshots of the site generated at certain tags. We are not currently testing that the current site including templates works with all prior versions of the guidelines, are we? I don't see the utility of doing so.

[gstrauss]

@mavit thank you for the PR. As I am sure you understand, this PR from 2021 is somewhat stale.

Recent changes to the code added output.hstsRedirectCode, which is currently hard-coded to 301. If in the future we use 308, that is what will change.

As we recently opened a discussion for updating the guidelines, I am also proposing using 308 for ssl-config-generator HSTS unconditional HTTP redirect from http:// to https://. That may or may not be part of the guidelines, but definitely won't be part of guideline v5.6 modified by this PR, so I am going to close this PR. We'll make changes pending the outcome of the discussions in #117.

Again, thank you for making the effort to submit this patch!