Makes the Strict-Transport-Security max-age a setting, per sneak's ruling on #271.
HSTS_MAX_AGE is a Go duration. Unset, it is 87600h (ten years), sent as max-age=315360000; includeSubDomains; preload. The default was two years before.
0 sends no Strict-Transport-Security header at all.
A negative value, or one that is not a whole number of seconds (1.5s), stops startup with an error naming the variable, as an unparseable value does. A fraction is refused, not rounded.
includeSubDomains and preload stay fixed; the ruling covers only the duration.
The value is shown on /settings and in the startup log line.
README: the HSTS section is rewritten for the setting, and the variable is added to the configuration table and to the list of values that abort startup.
Not visible in the diff:
A Config built in code, as tests do, has a zero HSTSMaxAge and so sends no header. Only config.New applies the default.
Disclosure: nothing above zero is refused, so a value under one year is accepted although REPO_POLICIES.md asks for at least one year. The ruling leaves the duration to the operator.
Reading taken, from the plan comment: "disable" means no header, not max-age=0. For browsers that already saw the header, the README says how to end the policy early: a short HSTS_MAX_AGE such as 1s, or max-age=0 sent by a reverse proxy.
The README's includeSubDomains text differs from the issue's premise: the header covers subdomains of the hostname that sends it, not of its parent domain.
Model: opus-5-5
Makes the `Strict-Transport-Security` max-age a setting, per sneak's ruling on https://git.eeqj.de/sneak/webhooker/issues/271.
- `HSTS_MAX_AGE` is a Go duration. Unset, it is `87600h` (ten years), sent as `max-age=315360000; includeSubDomains; preload`. The default was two years before.
- `0` sends no `Strict-Transport-Security` header at all.
- A negative value, or one that is not a whole number of seconds (`1.5s`), stops startup with an error naming the variable, as an unparseable value does. A fraction is refused, not rounded.
- `includeSubDomains` and `preload` stay fixed; the ruling covers only the duration.
- The value is shown on `/settings` and in the startup log line.
- README: the HSTS section is rewritten for the setting, and the variable is added to the configuration table and to the list of values that abort startup.
Not visible in the diff:
- A `Config` built in code, as tests do, has a zero `HSTSMaxAge` and so sends no header. Only `config.New` applies the default.
- Disclosure: nothing above zero is refused, so a value under one year is accepted although `REPO_POLICIES.md` asks for at least one year. The ruling leaves the duration to the operator.
- Reading taken, from the plan comment: "disable" means no header, not `max-age=0`. For browsers that already saw the header, the README says how to end the policy early: a short `HSTS_MAX_AGE` such as `1s`, or `max-age=0` sent by a reverse proxy.
- The README's `includeSubDomains` text differs from the issue's premise: the header covers subdomains of the hostname that sends it, not of its parent domain.
Model: opus-5-5
README.md line 898, section "HSTS": "A browser that sees the header refuses plaintext HTTP to that hostname until max-age runs out" is not true as written. Under RFC 6797 section 8.1 a browser ignores the header when it arrives over plain HTTP, and webhooker sends it on its plain-HTTP listener as well, so the sentence tells anyone who has opened webhooker at http://localhost:8080 that their browser now refuses plain HTTP there for ten years. Acceptable: the sentence says the header must arrive over HTTPS, for example "A browser that receives the header over HTTPS refuses plaintext HTTP to that hostname …".
Model: opus-5-5
Review failed: one finding.
- `README.md` line 898, section "HSTS": "A browser that sees the header refuses plaintext HTTP to that hostname until `max-age` runs out" is not true as written. Under RFC 6797 section 8.1 a browser ignores the header when it arrives over plain HTTP, and webhooker sends it on its plain-HTTP listener as well, so the sentence tells anyone who has opened webhooker at `http://localhost:8080` that their browser now refuses plain HTTP there for ten years. Acceptable: the sentence says the header must arrive over HTTPS, for example "A browser that receives the header over HTTPS refuses plaintext HTTP to that hostname …".
Model: opus-5-5
README.md HSTS section: the sentence now says the header must arrive over HTTPS, and adds that browsers ignore it over plain HTTP. The paragraph on HSTS_MAX_AGE=0 had the same mistake and now also says "received it over HTTPS".
Model: opus-5-5
- `README.md` HSTS section: the sentence now says the header must arrive over HTTPS, and adds that browsers ignore it over plain HTTP. The paragraph on `HSTS_MAX_AGE=0` had the same mistake and now also says "received it over HTTPS".
Model: opus-5-5
README.md lines 916-918, section "HSTS": "Only a max-age=0 header received over HTTPS clears it sooner. webhooker never sends one; a reverse proxy in front of it can." is not true. Under RFC 6797 section 8.1, every later header a browser receives over HTTPS replaces the max-age it stored. That means webhooker can end the policy early by itself: with HSTS_MAX_AGE=1s, a returning browser drops it one second after its next visit. As written, the README sends an operator who wants to back out to a reverse proxy, when 0 is the one setting that leaves earlier visitors held for the full max-age they saw. Acceptable: the paragraph says that a later header received over HTTPS replaces the stored max-age. Two things then end the policy sooner: a short HSTS_MAX_AGE such as 1s, kept until returning browsers have picked it up, or a max-age=0 header from a reverse proxy.
Model: opus-5-5
Review failed: one finding.
- `README.md` lines 916-918, section "HSTS": "Only a `max-age=0` header received over HTTPS clears it sooner. webhooker never sends one; a reverse proxy in front of it can." is not true. Under RFC 6797 section 8.1, every later header a browser receives over HTTPS replaces the `max-age` it stored. That means webhooker can end the policy early by itself: with `HSTS_MAX_AGE=1s`, a returning browser drops it one second after its next visit. As written, the README sends an operator who wants to back out to a reverse proxy, when `0` is the one setting that leaves earlier visitors held for the full `max-age` they saw. Acceptable: the paragraph says that a later header received over HTTPS replaces the stored `max-age`. Two things then end the policy sooner: a short `HSTS_MAX_AGE` such as `1s`, kept until returning browsers have picked it up, or a `max-age=0` header from a reverse proxy.
Model: opus-5-5
HSTS_MAX_AGE, a Go duration, sets the max-age of the
Strict-Transport-Security header. Unset, it is ten years (87600h);
0 sends no header at all. A negative value, or one that is not a
whole number of seconds, stops startup like an unparseable one.
includeSubDomains and preload stay in the header. The value is shown
on /settings and in the startup log, and the README's HSTS section
now says what each part of the header commits the operator to.
Model: opus-5-5
README.md section "HSTS": the last paragraph now says each header received over HTTPS replaces the stored max-age, and names both ways to end the policy sooner: a short HSTS_MAX_AGE such as 1s kept until returning browsers have picked it up, or max-age=0 from a reverse proxy. No other sentence in the section had the same error. The PR body line about this is updated to match.
Model: opus-5-5
- `README.md` section "HSTS": the last paragraph now says each header received over HTTPS replaces the stored `max-age`, and names both ways to end the policy sooner: a short `HSTS_MAX_AGE` such as `1s` kept until returning browsers have picked it up, or `max-age=0` from a reverse proxy. No other sentence in the section had the same error. The PR body line about this is updated to match.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Makes the
Strict-Transport-Securitymax-age a setting, per sneak's ruling on #271.HSTS_MAX_AGEis a Go duration. Unset, it is87600h(ten years), sent asmax-age=315360000; includeSubDomains; preload. The default was two years before.0sends noStrict-Transport-Securityheader at all.1.5s), stops startup with an error naming the variable, as an unparseable value does. A fraction is refused, not rounded.includeSubDomainsandpreloadstay fixed; the ruling covers only the duration./settingsand in the startup log line.Not visible in the diff:
Configbuilt in code, as tests do, has a zeroHSTSMaxAgeand so sends no header. Onlyconfig.Newapplies the default.REPO_POLICIES.mdasks for at least one year. The ruling leaves the duration to the operator.max-age=0. For browsers that already saw the header, the README says how to end the policy early: a shortHSTS_MAX_AGEsuch as1s, ormax-age=0sent by a reverse proxy.includeSubDomainstext differs from the issue's premise: the header covers subdomains of the hostname that sends it, not of its parent domain.Model: opus-5-5
Review failed: one finding.
README.mdline 898, section "HSTS": "A browser that sees the header refuses plaintext HTTP to that hostname untilmax-ageruns out" is not true as written. Under RFC 6797 section 8.1 a browser ignores the header when it arrives over plain HTTP, and webhooker sends it on its plain-HTTP listener as well, so the sentence tells anyone who has opened webhooker athttp://localhost:8080that their browser now refuses plain HTTP there for ten years. Acceptable: the sentence says the header must arrive over HTTPS, for example "A browser that receives the header over HTTPS refuses plaintext HTTP to that hostname …".Model: opus-5-5
c90afd9e35to9b39b865caREADME.mdHSTS section: the sentence now says the header must arrive over HTTPS, and adds that browsers ignore it over plain HTTP. The paragraph onHSTS_MAX_AGE=0had the same mistake and now also says "received it over HTTPS".Model: opus-5-5
Review failed: one finding.
README.mdlines 916-918, section "HSTS": "Only amax-age=0header received over HTTPS clears it sooner. webhooker never sends one; a reverse proxy in front of it can." is not true. Under RFC 6797 section 8.1, every later header a browser receives over HTTPS replaces themax-ageit stored. That means webhooker can end the policy early by itself: withHSTS_MAX_AGE=1s, a returning browser drops it one second after its next visit. As written, the README sends an operator who wants to back out to a reverse proxy, when0is the one setting that leaves earlier visitors held for the fullmax-agethey saw. Acceptable: the paragraph says that a later header received over HTTPS replaces the storedmax-age. Two things then end the policy sooner: a shortHSTS_MAX_AGEsuch as1s, kept until returning browsers have picked it up, or amax-age=0header from a reverse proxy.Model: opus-5-5
9b39b865cato7c9b241704README.mdsection "HSTS": the last paragraph now says each header received over HTTPS replaces the storedmax-age, and names both ways to end the policy sooner: a shortHSTS_MAX_AGEsuch as1skept until returning browsers have picked it up, ormax-age=0from a reverse proxy. No other sentence in the section had the same error. The PR body line about this is updated to match.Model: opus-5-5
Review passed.
Model: opus-5-5