Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

luci-base: add hardening header #1555

Closed
wants to merge 2 commits into from
Closed

luci-base: add hardening header #1555

wants to merge 2 commits into from

Commits on Jan 16, 2018

  1. luci-base: only send cookies over https connection 

    With this change the browser will only send the cookie over a
secure https connection.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
    @feckert
    feckert committed Jan 16, 2018
    Configuration menu
    Copy the full SHA
    86d411c View commit details
    Browse the repository at this point in the history

  2. luci-base: append Strict-Transport-Security header on https 

    The HTTP Strict-Transport-Security response header (often abbreviated as
HSTS) lets a web site tell browsers that it should only be accessed
using HTTPS, instead of using HTTP.

The Strict-Transport-Security header is ignored by the browser when your
site is accessed using HTTP; this is because an attacker may intercept
HTTP connections and inject the header or remove it.

So the header will only be send if luci is accessed over HTTPS. The "max-age"
expire time could be configured in "/etc/config/luci" main section with
the option "stricthttps".

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
    @feckert
    feckert committed Jan 16, 2018
    Configuration menu
    Copy the full SHA
    b02eeec View commit details
    Browse the repository at this point in the history