Merge pull request #27 from gbuesing/hstsfix

As per spec, don't include STS header in non-https responses

lib/rack/ssl.rb

@@ -51,8 +51,7 @@ def redirect_to_https(env)
         url.scheme = "https"
         url.host   = @host if @host
         status     = %w[GET HEAD].include?(req.request_method) ? 301 : 307
-        headers    = hsts_headers.merge('Content-Type' => 'text/html',
-                                        'Location'     => url.to_s)
+        headers    = { 'Content-Type' => 'text/html', 'Location' => url.to_s }
 
         [status, headers, []]
       end

test/test_ssl.rb

@@ -48,6 +48,11 @@ def test_hsts_header_by_default
       last_response.headers['Strict-Transport-Security']
   end
 
+  def test_no_hsts_with_insecure_connection
+    get "http://example.org/"
+    assert !last_response.headers['Strict-Transport-Security']
+  end
+
   def test_hsts_header
     self.app = Rack::SSL.new(default_app, :hsts => true)
     get "https://example.org/"