Add a HSTS header when 'https_only' is set

[ankon]

If the site is configured to only be reachable via HTTPS, then it really makes sense to also tell the browser to remember that choice using the Strict-Transport-Security header (https://tools.ietf.org/html/rfc6797).

Note that the value chosen here is fairly long, so when just playing with https_only people might get confused when the browser forces HTTPS even when they switch off that setting again. Maybe it would be really be sensible to either:

• use a different option
• use a tri-state option for https_only: true, false, 'yes-including-hsts-i-really-mean-it'

What do you think?

[hone]

@jmervine thoughts here?

[jmervine]

👍 , except, I wouldn't merge it until it's configurable, where false || 0 || nil (or something like that) == off.

[hone]

would a number value configure the max-age then?

[jmervine]

Yes, "31536000" should be the highest allowed value AFAIK. This is one of those -- "I can't think of why you'd want to set something else, but I can't speak to everyone's use cases" -- situations, which is why I recommend making it toggle-able / configurable.

[jmervine]

@rdsharma

[edmorley]

Hi

This buildpack is now deprecated and we are recommending people move the more actively maintained heroku-buildpack-nginx. For migration advice see here.

As such, I'm closing this PR out since we won't be making further changes to this buildpack.