GNUsocial/gnu-social
4
0
Fork 1
Code Issues Releases Wiki Activity

Allow adding preload token to HSTS header

Browse Source 
Use by adding this to config.php:

addPlugin('StrictTransportSecurity', array('preloadToken'=>true));
This commit is contained in:
Mikael Nordfeldth 2015-05-03 23:05:47 +02:00
parent 6d72800098
commit cd42ee7e85
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
plugins/StrictTransportSecurity/StrictTransportSecurityPlugin.php
View File

@ -33,6 +33,7 @@ class StrictTransportSecurityPlugin extends Plugin
{
public $max_age = 15552000;
public $includeSubDomains = false;
public $preloadToken = false;
function __construct()
{
@ -44,7 +45,8 @@ class StrictTransportSecurityPlugin extends Plugin
$path = common_config('site', 'path');
if(common_config('site', 'ssl') == 'always' && ($path == '/' || ! $path )) {
header('Strict-Transport-Security: max-age=' . $this->max_age
. ($this->includeSubDomains ? '; includeSubDomains' : ''));
. ($this->includeSubDomains ? '; includeSubDomains' : '')
. ($this->preloadToken ? '; preload' : ''));
}
}