Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support HSTS and turn on by default #39

Closed
tim-seoss opened this issue May 13, 2021 · 3 comments · Fixed by #44
Closed

Support HSTS and turn on by default #39

tim-seoss opened this issue May 13, 2021 · 3 comments · Fixed by #44
Assignees
@joseluisq
Labels
enhancement New feature or request v2 v2 release

Comments

@tim-seoss
Copy link
Contributor

https web servers should support RFC 6797 "HTTP Strict Transport Security (HSTS)".

This should probably be on by default, and also default to a sensible time period (e.g. 2 years). A command-line switch could optionally disable HSTS (e.g. --hsts-seconds=0).

https://www.globalsign.com/en/blog/what-is-hsts-and-how-do-i-use-it
@joseluisq
Copy link
Collaborator

Yeah, that's good idea since this normally tends to happen at proxy level.

@joseluisq joseluisq added enhancement New feature or request help wanted Extra attention is needed v2 v2 release labels May 13, 2021
@joseluisq joseluisq self-assigned this Jun 11, 2021
@joseluisq joseluisq removed the help wanted Extra attention is needed label Jun 11, 2021
@joseluisq joseluisq mentioned this issue Jun 11, 2021
Merged
5 tasks
@joseluisq joseluisq added the beta It will be included in a beta release label Jun 22, 2021
@joseluisq
Copy link
Collaborator

Feature request released on v2.0.0-beta.5

@tim-seoss
Copy link
Contributor Author

I'll check it out, thanks!

@joseluisq joseluisq removed the beta It will be included in a beta release label Jul 17, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@joseluisq joseluisq

Labels
enhancement New feature or request v2 v2 release
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Security headers for HTTP/2 by default static-web-server/static-web-server
2 participants
@joseluisq @tim-seoss