external/mailinabox
1
0
Förgrening 0
spegling av https://github.com/mail-in-a-box/mailinabox.git synced 2026-09-09 23:59:00 +02:00
Kod Ärenden Släpp Wiki Aktiviteter

Add 'always' modifier to the HSTS add_header directive (#1790)

Bläddra i källkod 
This will make it so that the HSTS header is sent regardless of the request status code (until this point it would only be sent if "the response code equals 200, 201, 206, 301, 302, 303, 307, or 308." - according to thttp://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)
This commit is contained in:
David Duque
2020-07-16 12:21:14 +01:00
committad av GitHub
förälder e6102eacfb
incheckning 1b2711fc42
1 ändrade filer med 2 tillägg och 2 borttagningar
Download Patch File Download Diff File Expand all files Collapse all files

4
management/web_update.py
Visa fil

@@ -188,9 +188,9 @@ def make_domain_config(domain, templates, ssl_certificates, env):
# Add the HSTS header. # Add the HSTS header.
if hsts == "yes": if hsts == "yes":
nginx_conf_extra += "add_header Strict-Transport-Security max-age=15768000;\n" nginx_conf_extra += "add_header Strict-Transport-Security \"max-age=15768000\" always;\n"
elif hsts == "preload": elif hsts == "preload":
nginx_conf_extra += "add_header Strict-Transport-Security \"max-age=15768000; includeSubDomains; preload\";\n" nginx_conf_extra += "add_header Strict-Transport-Security \"max-age=15768000; includeSubDomains; preload\" always;\n"
# Add in any user customizations in the includes/ folder. # Add in any user customizations in the includes/ folder.
nginx_conf_custom_include = os.path.join(env["STORAGE_ROOT"], "www", safe_domain_name(domain) + ".conf") nginx_conf_custom_include = os.path.join(env["STORAGE_ROOT"], "www", safe_domain_name(domain) + ".conf")