<!--
	National Science Foundation

	For other US government coverage, see US-government.xml.


	Nonfunctional hosts in *nsf.gov:

		- dellweb.bfa *

	* Refused


	Insecure cookies are set for these hosts:

		- www.nsf.gov


	Mixed content:

		- Bug on www from wt.research.gov *

	* Not secured by us <= missing certificate chain

-->
<ruleset name="NSF.gov (partial)">

	<!--	Direct rewrites:
				-->
	<target host="www.fastlane.nsf.gov" />
	<target host="www.fldemo.nsf.gov" />
	<target host="www.nsf.gov" />

	<!--	Complications:
				-->
	<target host="nsf.gov" />
	<target host="fastlane.nsf.gov" />
	<target host="fldemo.nsf.gov" />


		<exclusion pattern="^http://www\.nsf\.gov/(?:$|\?|index\.jsp|awardsearch|statistics)" />

			<test url="http://www.nsf.gov/index.jsp" />
			<test url="http://www.nsf.gov/awardsearch" />
			<test url="http://www.nsf.gov/awardsearch/" />
			<test url="http://www.nsf.gov/statistics" />
			<test url="http://www.nsf.gov/statistics/" />


	<!--	Not secured by server:
					-->
	<!--securecookie host="^www\.nsf\.gov$" name="^JSESSIONID$" /-->

	<securecookie host="^.*\.nsf\.gov$" name=".*" />


	<!--	These paths redirect to http:

			- $
			- awardsearch$
			- awardsearch/$
			- awardsearch/common/images/
			- awardsearch/style/
			- index.jsp$
			- statistics/$
			- statistics/about.cfm$
			- statistics/css/
			- statistics/graphics/
			- statistics/profiles/$
			- statistics/showpub.cfm

		These paths don't (shh!):

			- about
			- awards
			- bfa
			- cgi-bin
			- css
			- discoveries
			- email.jsp
			- funding
			- help
			- images
			- news
			- oirm
			- policies
			- staff


		Cert only matches www.
						
	<rule from="^http://(?:www\.)?nsf\.gov/((?:about|awards|bfa|cgi-bin|css|discoveries|funding|help|images|news|oirm|policies|publications|staff)(?:$|/|\?)|email\.jsp)"
		to="https://www.nsf.gov/$1" /-->

	<!--	Cert only matches www.foo	-->
	<rule from="^http://(fastlane\.|fldemo\.)?nsf\.gov/"
		to="https://www.$1nsf.gov/" />

	<rule from="^http:"
		to="https:" />

</ruleset>

