<!--
	For problematic rules, see Washington-Post-Company-mismatches.xml.


	Other Washington Post Company rulesets:

		- WaPo_Labs.com.xml
		- Wash_Post.com.xml
		- WP_digital.net.xml


	CDN buckets:

		- washingtonpost.com.112.2o7.net

			- metrics

		- washpost.bloomberg.com

		- d2t2kgdkdgawhh.cloudfront.net

			- wp-eng-static.washingtonpost.com

		- css.washingtonpost.com.edgesuite.net
		- js.washingtonpost.com.edgesuite.net
		- media[23]?.washingtonpost.com.edgesuite.net
		- projects.washingtonpost.com.edgesuite.net
		- www.washingtonpost.com.edgesuite.net

		- knowmore.washingtonpost.com.inscname.net

		- washingtonpost-001.inscname.net

			- apps.washingtonpost.com

		- s5.parature.com

			- help.washingtonpost.com

		- pqasb.pqarchiver.com/washingtonpost/


	Problematic domains:

		- help.washingtonpost.com		(works; mismatched, CN: *.parature.com)
		- metrics.washingtonpost.com		(mismatched, CN: *.112.2o7.net)
		- wp-eng-static.washingtonpost.com	(cloudfront)


	Nonfunctional domains:

		- www.slate.com *

		- washingtonpost.com subdomains:

			- ^			(refused)
			- apps			(404; mismatched, CN: ssl001.insnw.net)
			- css **
			- img **
			- js **
			- knowmore		(404; mismatched, CN: ssl001.insnw.net)
			- media **
			- media2 *
			- media3 **
			- origin		(refused, redirects to www)
			- projects **
			- pwapi			(refused)
			- www *

	* 504, akamai
	** 503, akamai


	Problematic domains:

		- (www.)wapo.st				(times out)
		- findnsave.washingtonpost.com		(mismatched, CN: *.findnsave.com)
		- (www.)washingtonpostmedia.com		(mismatched, CN: washpost.com)
		- (www.)washpostco.com			(akamai, mostly corporate-ir.net)


	Partially covered domains:

		- js.washintonpost.com	(→ ssl, ads 404)


	Fully covered domains:

		- wapo.st	(→ bit.ly)

		- washingtonpost.com subdomains:

			- account
			- css ¹
			- id
			- metrics	(→ washingtonpost-com.112.2o7.net)
			- ssl ²
			- ssl1 ²
			- subscription
			- voices
			- wp-eng-static		(→ d2t2kgdkdgawhh.cloudfront.net)

	¹ → ssl.washingtonpost.com
	² Server is configured for ssl3 only


	www no longer works when rewritten to ssl.


	Observed cookie domains:

		- .washingtonpost.com ¹
		- account.washingtonpost.com ²
		- findnsave.washingtonpost.com ¹
		- .findnsave.washingtonpost.com ¹ ³
		- id.washingtonpost.com ²
		- knowmore.washingtonpost.com ⁴

	¹ We can't secure any of these as we have no method for
	  forcing the secure attribute for cookies that are set
	  from a domain that is also accessed via unencrypted http.

	² Secured by us
	³ Tracking cookies
	⁴ Not secured by us

-->
<ruleset name="Washington Post Company (unreliable)" default_off="needs testing">

	<target host="wapo.st" />
	<target host="*.washingtonpost.com" />
		<!--
			404 when rewritten to ssl1.
							-->
	<exclusion pattern="^https?://(?:js\.|www\.)?washingtonpost\.com/wp-srv/(?:ad|javascript|blogs)/" />


	<!--	Could we secure any of these safely?
							-->
	<!--securecookie host="^\.washingtonpost\.com$" name="^(client_region|de|devicetype|galleryPlays|rpld0|rpld1|s_pers|s_sess|s_vi|wapo_last_ip|wapo_saved_ip|wapo_sess_id|wapo_vis_id|wp_pageview)$" /-->
	<!--securecookie host=".*\.washingtonpost\.com$" name=".+" /-->
	<securecookie host="^(?:account|id)\.washingtonpost\.com$" name=".+" />
	<!--securecookie host="^findnsave\.washingtonpost\.com$" name="^csrftoken$" /-->
	<!--securecookie host="^\.findnsave\.washingtonpost\.com$" name=".+" /-->
	<!--securecookie host="^knowmore.washingtonpost.com$" name="^wpni_poe$" /-->
	<!--securecookie host="^www\.washingtonpost\.com$" name="^(backplane-channel|photoJSONAdConfig|wpni_poe)$" /-->


	<rule from="^http://wapo\.st/"
		to="https://bit.ly/" />

	<rule from="^http://(account|id|ssl1?|subscription|voices)\.washingtonpost\.com/"
		to="https://$1.washingtonpost.com/" />

	<rule from="^http://(?:css|js|media)\.washingtonpost\.com/"
		to="https://ssl.washingtonpost.com/" />

	<rule from="^http://metrics\.washingtonpost\.com/"
		to="https://washingtonpost-com.112.2o7.net/" />

	<rule from="^http://wp-eng-static\.washingtonpost\.com/"
		to="https://d2t2kgdkdgawhh.cloudfront.net/" />

</ruleset>
