qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-18 10:54:40 -07:00
Code Releases Activity

cmd/godoc,cmd/tip: enable HSTS preload

Browse Source 
Add the includeSubDomains directive to meet the requirements
for being added to the preload list described at https://hstspreload.org/.

Updates golang/go#26162

Change-Id: I415775aa523bcef3a52f1853de033f343b914e83
Reviewed-on: https://go-review.googlesource.com/122175
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
This commit is contained in:
Agniva De Sarker 2018-07-04 09:14:33 +05:30 committed by Brad Fitzpatrick
parent 16f8f9bb72
commit 435878328f
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cmd/godoc/handlers.go
View File

@ -55,7 +55,7 @@ func (h hostEnforcerHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
http.Redirect(w, r, r.URL.String(), http.StatusFound)
return
}
w.Header().Set("Strict-Transport-Security", "max-age=31536000; preload")
w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload")
h.h.ServeHTTP(w, r)
}

2
cmd/tip/tip.go
View File

@ -408,7 +408,7 @@ func (h httpsOnlyHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
if r.Header.Get("X-Appengine-Https") == "on" || r.Header.Get("X-Forwarded-Proto") == "https" ||
(!isProxiedReq(r) && r.TLS != nil) {
// Only set this header when we're actually in production.
w.Header().Set("Strict-Transport-Security", "max-age=31536000; preload")
w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload")
}
h.h.ServeHTTP(w, r)
}