Adding all HSTS options

magfest · Nov 29, 2023 · f0b7663 · f0b7663
1 parent 3d43eca
commit f0b7663
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/uber/configspec.ini b/uber/configspec.ini
@@ -1883,6 +1883,8 @@ prefix = string(default="")
 
 [hsts]
 max_age = integer(default=31536000)
+preload = boolean(default=False)
+include_subdomains = boolean(default=False)
 
 [appconf]
 # This is all CherryPy configuration.

diff --git a/uber/server.py b/uber/server.py
@@ -49,7 +49,17 @@ def sentry_end_transaction():
 @cherrypy.tools.register('before_finalize', priority=60)
 def secureheaders():
     headers = cherrypy.response.headers
-    headers['Strict-Transport-Security'] = 'max-age=' + str(c.HSTS['max_age'])
+    hsts_header = 'max-age=' + str(c.HSTS['max_age'])
+    if c.HSTS['include_subdomains']:
+        hsts_header += '; includeSubDomains'
+    if c.HSTS['preload']:
+        if c.HSTS['max_age'] < 31536000:
+            log.error('HSTS only supports preloading if max-age > 31536000')
+        elif not c.HSTS['include_subdomains']:
+            log.error('HSTS only supports preloading if subdomains are included')
+        else:
+            hsts_header += '; preload'
+    headers['Strict-Transport-Security'] = hsts_header
 
 def _add_email():
     [body] = cherrypy.response.body