Enable HSTS with IncludeSubdomains header by default for new apps

[prathamesh-sonpatki]

Fixes #22663

[rafaelfranca]

Instead of a new option can we set Rails.application.config.action_dispatch.ssl_options = { subdomains: true }?

[prathamesh-sonpatki]

@rafaelfranca That will mess up with existing ssl_options present in config/environments/production.rb right?

[rafaelfranca]

Is there any existent in production.rb? I could not find it in the repository. If that is the case we can try to use merge with the already existent value.

[prathamesh-sonpatki]

Ah okey config.ssl_options is different that config.action_dispatch.ssl_options.

But you meant reusing config.ssl_options right?

[rafaelfranca]

Right. config.ssl_options

[prathamesh-sonpatki]

@rafaelfranca We can do

Rails.application.config.ssl_options.merge!({ hsts: { subdomains: true } })

But that can mess up with setting the default hsts options here - https://github.com/prathamesh-sonpatki/rails/blob/master/actionpack/lib/action_dispatch/middleware/ssl.rb#L82.

Note that we are passing options only in case of https://github.com/prathamesh-sonpatki/rails/blob/master/actionpack/lib/action_dispatch/middleware/ssl.rb#L92.

options are config.ssl_options[:hsts]

So if we want to reuse config.ssl_options then we will have to update each branch in https://github.com/prathamesh-sonpatki/rails/blob/master/actionpack/lib/action_dispatch/middleware/ssl.rb#L82 to pass options[:subdomains].

It will override user's config.ssl_options[:hsts] though as we will have a default hash instead of true/false/nil/custom options.

[rafaelfranca]

I don't get that is the problem. If we merged { expires: HSTS_EXPIRES_IN, subdomains: false, preload: false } with { subdomain: true } would not the result be { expires: HSTS_EXPIRES_IN, subdomains: true, preload: false }?

>> default = { expires: 1, subdomains: false, preload: false }
=> {:expires=>1, :subdomains=>false, :preload=>false}
>> default.merge(subdomains: true)
=> {:expires=>1, :subdomains=>true, :preload=>false}

[prathamesh-sonpatki]

@rafaelfranca Made the change as per our discussion. This will make sure that we don't mess up with user's config.ssl_options[:hsts]. It can be false or true or whatever, it will still remain that value after this initializer will get run.

[rafaelfranca]

We can just set the ssl_option directly, not need to merge. This line will be generated only in new applications, so there is no ssl_options set anywhere. For existent applications we will let the deprecation warning handle it.

We will need to update the config_when_updating method in the generators to not generate this file.

Also it should be named ssl_options.rb

[prathamesh-sonpatki]

r? @rafaelfranca Please review.