Issue 51904: Strict-Transport-Security header when HTTPS is required #6168
Conversation
|
@labkey-adam @labkey-matthewb no need to rush to adopt this but it was easy so I figured I'd open the PR before the holidays |
| @@ -164,6 +165,11 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha | |||
| return; | |||
| } | |||
|
|
|||
| if (sslRequired) | |||
There was a problem hiding this comment.
Consider adding a devMode check. I believe the reason we don't already have this is because it is incredibly sticky. If you do this on a dev machine and test SSL, you won't be able to use http: until next year or until you figure out how to make your browser forget this setting.
There was a problem hiding this comment.
Ask me how I know...
There was a problem hiding this comment.
That's a good idea. Update pushed.
We could, but I saw commentary that it's only supposed to be set for HTTPS responses. Apparently browsers ignore it for plain HTTP |
That makes sense actually. |
Rationale
We have many protections in place already to ensure that traffic is always over HTTPS. We can set this header to catch an edge case for an initial http:// request on a third-party link.
Changes
Strict-Transport-Securityheader when the server is already requiring HTTPS connections