Skip to content
Permalink
Browse files

Update default HSTS max-age value to 1 year

- Update the default HSTS max-age value to 31536000 seconds (1 year)
  to meet the minimum max-age requirement for https://hstspreload.org/.
  • Loading branch information...
grantbdev authored and guilleiguaran committed Jan 17, 2018
1 parent eab23b6 commit 30b5f469a1d30c60d1fb0605e84c50568ff7ed37
@@ -1,3 +1,8 @@
* Update the default HSTS max-age value to 31536000 seconds (1 year)
to meet the minimum max-age requirement for https://hstspreload.org/.

*Grant Bourque*

* Add support for automatic nonce generation for Rails UJS

Because the UJS library creates a script tag to process responses it
@@ -26,8 +26,8 @@ module ActionDispatch
# Set +config.ssl_options+ with <tt>hsts: { ... }</tt> to configure HSTS:
#
# * +expires+: How long, in seconds, these settings will stick. The minimum
# required to qualify for browser preload lists is 18 weeks. Defaults to
# 180 days (recommended).
# required to qualify for browser preload lists is 1 year. Defaults to
# 1 year (recommended).
#
# * +subdomains+: Set to +true+ to tell the browser to apply these settings
# to all subdomains. This protects your cookies from interception by a
@@ -47,9 +47,8 @@ module ActionDispatch
class SSL
# :stopdoc:

# Default to 180 days, the low end for https://www.ssllabs.com/ssltest/
# and greater than the 18-week requirement for browser preload lists.
HSTS_EXPIRES_IN = 15552000
# Default to 1 year, the minimum for browser preload lists.
HSTS_EXPIRES_IN = 31536000

def self.default_hsts_options
{ expires: HSTS_EXPIRES_IN, subdomains: true, preload: false }
@@ -98,8 +98,8 @@ def assert_post_redirected(redirect: {}, from: "http://a/b?c=d",
end

class StrictTransportSecurityTest < SSLTest
EXPECTED = "max-age=15552000"
EXPECTED_WITH_SUBDOMAINS = "max-age=15552000; includeSubDomains"
EXPECTED = "max-age=31536000"
EXPECTED_WITH_SUBDOMAINS = "max-age=31536000; includeSubDomains"

def assert_hsts(expected, url: "https://example.org", hsts: { subdomains: true }, headers: {})
self.app = build_app ssl_options: { hsts: hsts }, headers: headers

0 comments on commit 30b5f46

Please sign in to comment.
You can’t perform that action at this time.