Skip to content

bugzilla
bugzilla
Commit 4a85d6d1 authored by Reed Loden's avatar Reed Loden
Browse files
Options

Bug 562475 - "Bugzilla should use strict-transport-security (STS) headers"

[r=mkanat a=mkanat]
parent d386a4e8
Hide whitespace changes
Inline Side-by-side
Showing with 11 additions and 0 deletions
Bugzilla/CGI.pm
View file @ 4a85d6d1
...@@ -285,6 +285,12 @@ sub header { ...@@ -285,6 +285,12 @@ sub header {
unshift(@_, '-cookie' => $self->{Bugzilla_cookie_list}); unshift(@_, '-cookie' => $self->{Bugzilla_cookie_list});
} }
# Add Strict-Transport-Security (STS) header if this response
# is over SSL and ssl_redirect is enabled.
if ($self->https && Bugzilla->params->{'ssl_redirect'}) {
unshift(@_, '-strict-transport-security' => 'max-age=' . MAX_STS_AGE);
}
return $self->SUPER::header(@_) || ""; return $self->SUPER::header(@_) || "";
} }
......
Bugzilla/Constants.pm
View file @ 4a85d6d1
...@@ -160,6 +160,7 @@ use File::Basename; ...@@ -160,6 +160,7 @@ use File::Basename;
MAX_LOGINCOOKIE_AGE MAX_LOGINCOOKIE_AGE
MAX_LOGIN_ATTEMPTS MAX_LOGIN_ATTEMPTS
LOGIN_LOCKOUT_INTERVAL LOGIN_LOCKOUT_INTERVAL
MAX_STS_AGE
SAFE_PROTOCOLS SAFE_PROTOCOLS
LEGAL_CONTENT_TYPES LEGAL_CONTENT_TYPES
...@@ -421,6 +422,10 @@ use constant MAX_LOGIN_ATTEMPTS => 5; ...@@ -421,6 +422,10 @@ use constant MAX_LOGIN_ATTEMPTS => 5;
# account is locked. # account is locked.
use constant LOGIN_LOCKOUT_INTERVAL => 30; use constant LOGIN_LOCKOUT_INTERVAL => 30;
# The maximum number of seconds the Strict-Transport-Security header
# will remain valid. Default is one week.
use constant MAX_STS_AGE => 604800;
# Protocols which are considered as safe. # Protocols which are considered as safe.
use constant SAFE_PROTOCOLS => ('afs', 'cid', 'ftp', 'gopher', 'http', 'https', use constant SAFE_PROTOCOLS => ('afs', 'cid', 'ftp', 'gopher', 'http', 'https',
'irc', 'mid', 'news', 'nntp', 'prospero', 'telnet', 'irc', 'mid', 'news', 'nntp', 'prospero', 'telnet',
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment