Add 'hsts' as config option

This commit is contained in:
Omar Roth 2019-05-14 08:21:01 -05:00
parent e833ccf309
commit 97ef2191fd
No known key found for this signature in database
GPG Key ID: B8254FB7EC3D37F2
2 changed files with 5 additions and 2 deletions

View File

@ -193,7 +193,7 @@ before_all do |env|
env.response.headers["Content-Security-Policy"] = "default-src blob: data: 'self' #{host_url} 'unsafe-inline' 'unsafe-eval'; media-src blob: 'self' #{host_url} https://*.googlevideo.com:443"
env.response.headers["Referrer-Policy"] = "same-origin"
if Kemal.config.ssl || config.https_only
if (Kemal.config.ssl || config.https_only) && config.hsts
env.response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains; preload"
end
@ -5355,7 +5355,9 @@ if Kemal.config.ssl
redirect_url += "?#{env.request.query}"
end
env.response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains; preload"
if config.hsts
env.response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains; preload"
end
env.response.headers["Location"] = redirect_url
env.response.status_code = 301
end

View File

@ -128,6 +128,7 @@ user: String,
check_tables: {type: Bool, default: false}, # Check table integrity, automatically try to add any missing columns, create tables, etc.
cache_annotations: {type: Bool, default: false}, # Cache annotations requested from IA, will not cache empty annotations or annotations that only contain cards
banner: {type: String?, default: nil}, # Optional banner to be displayed along top of page for announcements, etc.
hsts: {type: Bool?, default: true}, # Enables 'Strict-Transport-Security'. Ensure that `domain` and all subdomains are served securely
})
end