Serve Strict-Transport-Security header on HTTPS responses

src/subcommand/serve.rs

@@ -295,16 +295,6 @@ impl Serve {
     Redirect::to(&destination)
   }
 
-  fn redirect_router(destination: String) -> Router {
-    Router::new()
-      .fallback(Self::redirect_http_to_https)
-      .layer(Extension(destination))
-      .layer(SetResponseHeaderLayer::overriding(
-        header::X_CONTENT_TYPE_OPTIONS,
-        HeaderValue::from_static("nosniff"),
-      ))
-  }
-
   pub(crate) fn router(server: Arc<Server>, auth_config: Option<Arc<AuthConfig>>) -> Router {
     let router = Router::new()
       .route("/", get(Self::home))
@@ -498,6 +488,11 @@ impl Serve {
           .clone()
           .unwrap_or_else(|| data_dir.join("acme-cache"));
 
+        let router = router.layer(SetResponseHeaderLayer::overriding(
+          header::STRICT_TRANSPORT_SECURITY,
+          HeaderValue::from_static("max-age=31536000"),
+        ));
+
         axum_server::from_tcp(listener)
           .context(error::Serve)?
           .handle(handle)
@@ -507,10 +502,18 @@ impl Serve {
           .context(error::Serve)?;
       }
       SpawnConfig::Redirect(destination) => {
+        let router = Router::new()
+          .fallback(Self::redirect_http_to_https)
+          .layer(Extension(destination))
+          .layer(SetResponseHeaderLayer::overriding(
+            header::X_CONTENT_TYPE_OPTIONS,
+            HeaderValue::from_static("nosniff"),
+          ));
+
         axum_server::from_tcp(listener)
           .context(error::Serve)?
           .handle(handle)
-          .serve(Self::redirect_router(destination).into_make_service())
+          .serve(router.into_make_service())
           .await
           .context(error::Serve)?;
       }

src/subcommand/serve/tests.rs

@@ -1240,40 +1240,6 @@ fn ports() {
   );
 }
 
-#[test]
-fn redirect_destination() {
-  let domains = vec!["foo".to_string()];
-
-  assert_eq!(Serve::redirect_destination(&domains, 443), "https://foo");
-  assert_eq!(
-    Serve::redirect_destination(&domains, 8443),
-    "https://foo:8443",
-  );
-}
-
-#[test]
-fn redirect_http_to_https() {
-  fn case(path: &str, location: &str) {
-    let response = RUNTIME
-      .block_on(
-        Serve::redirect_router("https://foo".into())
-          .oneshot(Request::builder().uri(path).body(Body::empty()).unwrap()),
-      )
-      .unwrap();
-
-    assert_eq!(response.status(), StatusCode::SEE_OTHER);
-    assert_eq!(response.headers()[header::LOCATION], location);
-    assert_eq!(
-      response.headers()[header::X_CONTENT_TYPE_OPTIONS],
-      "nosniff"
-    );
-  }
-
-  case("/", "https://foo/");
-  case("/bar", "https://foo/bar");
-  case("/bar?baz=qux", "https://foo/bar?baz=qux");
-}
-
 #[test]
 fn restricted_upload_accepts_admin_token() {
   let admin = PrivateKey::generate();

tests/serve.rs

@@ -35,3 +35,53 @@ fn http2_is_supported() {
 
   server.terminate().success();
 }
+
+#[test]
+fn redirect_http_to_https() {
+  #[track_caller]
+  fn case(client: &reqwest::blocking::Client, address: &str, path: &str, location: &str) {
+    let response = client.get(format!("{address}{path}")).send().unwrap();
+
+    assert_eq!(response.status(), StatusCode::SEE_OTHER);
+    assert_eq!(response.headers()[reqwest::header::LOCATION], location);
+    assert_eq!(
+      response.headers()[reqwest::header::X_CONTENT_TYPE_OPTIONS],
+      "nosniff",
+    );
+  }
+
+  let server = Test::new()
+    .ready_address()
+    .stderr_regex(".*")
+    .args([
+      "serve",
+      "--address",
+      "127.0.0.1",
+      "--http-port",
+      "0",
+      "--https-port",
+      "0",
+      "--redirect-http-to-https",
+      "--domain",
+      "foo",
+    ])
+    .spawn();
+
+  let client = reqwest::blocking::Client::builder()
+    .redirect(reqwest::redirect::Policy::none())
+    .build()
+    .unwrap();
+
+  let address = server.address();
+
+  case(&client, &address, "/", "https://foo:0/");
+  case(&client, &address, "/bar", "https://foo:0/bar");
+  case(
+    &client,
+    &address,
+    "/bar?baz=qux",
+    "https://foo:0/bar?baz=qux",
+  );
+
+  server.terminate().success();
+}