HTTP Strict Transport Security (HSTS) header support is not conform spec

[sindlar]

HSTS support in akka-http is not conform spec:

• Trailing semicolons are not supported; see here for an occurrence of this bug in the wild.
• A fixed order of directives is assumed.

See below for a summary of the HSTS header definition.

HSTS header definition

The HSTS spec, Section 6 defines the HSTS header value through the following ABNF syntax:

     Strict-Transport-Security = "Strict-Transport-Security" ":"
                                 [ directive ]  *( ";" [ directive ] )
     directive                 = directive-name [ "=" directive-value ]
     directive-name            = token
     directive-value           = token | quoted-string

From the ABNF spec, Section 2, the following parts are relevant:

   *rule
      The character "*" preceding an element indicates repetition. The
      full form is "<n>*<m>element" indicating at least <n> and at most
      <m> occurrences of element. Default values are 0 and infinity so
      that "*(element)" allows any number, including zero; "1*element"
      requires at least one; and "1*2element" allows one or two.
   [rule]
      Square brackets enclose optional elements; "[foo bar]" is
      equivalent to "*1(foo bar)".

Thus, the HSTS header value syntax can be rewritten to

     Strict-Transport-Security = "Strict-Transport-Security" ":"
                                 0*1( directive )  0*∞( ";" 0*1( directive ) )

In words, this means the value of the HSTS header has

• an optional directive,
• followed by any number (0 to infinity) of the following successive elements
  • semicolon
  • an optional directive

In addition to this syntax, the HSTS spec, Section 6.1 imposes some requirements, summarized below insofar as relevant to this issue:

• The order of appearance of directives is not significant.
• All directives MUST appear only once in an STS header field. Directives are either optional or required, as stipulated in their definitions.
• Unrecognized directives must be ignored.
• The 'max-age' directive is REQUIRED.
• The 'includeSubDomains' directive is OPTIONAL.