Add HSTS header

1 files changed, 12 insertions, 1 deletions

diff --git a/roseh.moe.go b/roseh.moe.go
index 67b13c1..bd07aed 100644
--- a/roseh.moe.go
+++ b/roseh.moe.go
@@ -1402,6 +1402,17 @@ type removeAuthCookieHandler struct {
 	h http.Handler
 }
 
+type hstsHandler struct {
+	h http.Handler
+}
+
+func (h *hstsHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if *https != "" {
+		w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
+	}
+	h.h.ServeHTTP(w, r)
+}
+
 func (h *removeAuthCookieHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	/*var cookies []*http.Cookie
 	for _, c := range r.Cookies() {
@@ -1536,7 +1547,7 @@ func main() {
 		},
 	}}})
 	server := &http.Server{
-		Handler: &loggingHandler{http.NewCrossOriginProtection().Handler(serverMux)},
+		Handler: &loggingHandler{http.NewCrossOriginProtection().Handler(&hstsHandler{serverMux})},
 
 		ReadHeaderTimeout: 5 * time.Minute,
 		IdleTimeout:       10 * time.Minute,