Commit 0aeaae04 authored by Reed Loden's avatar Reed Loden

Bug 600475 - Support the 'includeSubDomains' flag as an option for the…

Bug 600475 - Support the 'includeSubDomains' flag as an option for the 'Strict-Transport-Security' advanced option in order to protect subdomains. [r=glob a=mkanat]
parent f63ac679
......@@ -276,8 +276,12 @@ sub header {
# Add Strict-Transport-Security (STS) header if this response
# is over SSL and the strict_transport_security param is turned on.
if ($self->https && Bugzilla->params->{'strict_transport_security'}) {
unshift(@_, '-strict-transport-security' => 'max-age=' . MAX_STS_AGE);
if ($self->https && Bugzilla->params->{'strict_transport_security'} ne 'off') {
my $sts_opts = 'max-age=' . MAX_STS_AGE;
if (Bugzilla->params->{'strict_transport_security'} eq 'include_subdomains') {
$sts_opts .= '; includeSubDomains';
}
unshift(@_, '-strict_transport_security' => $sts_opts);
}
return $self->SUPER::header(@_) || "";
......
......@@ -55,8 +55,10 @@ use constant get_param_list => (
{
name => 'strict_transport_security',
type => 'b',
default => 0,
type => 's',
choices => ['off', 'this_domain_only', 'include_subdomains'],
default => 'off',
checker => \&check_multi
},
);
......
......@@ -35,6 +35,22 @@
on its domain (i.e., your <code>urlbase</code> is something like
<code>http://bugzilla.example.com/</code>), and you never plan to disable
the <code>ssl_redirect</code> parameter.
<ul>
<li>
off - Don't send the Strict-Transport-Security header with requests.
</li>
<li>
this_domain_only - Send the Strict-Transport-Security header with all
requests, but only support it for the current domain.
</li>
<li>
include_subdomains - Send the Strict-Transport-Security header along
with the <code>includeSubDomains</code> flag, which will apply the
security change to all subdomains. This is especially useful when
combined with an <code>attachment_base</code> that exists as (a)
subdomain(s) under the main [% terms.Bugzilla %] domain.
</li>
</ul>
[% END %]
[% param_descs = {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment