From 072fb01f981841c785ac4b501292451189939281 Mon Sep 17 00:00:00 2001 From: Rose Hogenson Date: Tue, 20 Oct 2026 18:16:07 -0700 Subject: Add HSTS header --- roseh.moe.go | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/roseh.moe.go b/roseh.moe.go index 67b13c1..bd07aed 100644 --- a/roseh.moe.go +++ b/roseh.moe.go @@ -1402,6 +1402,17 @@ type removeAuthCookieHandler struct { h http.Handler } +type hstsHandler struct { + h http.Handler +} + +func (h *hstsHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { + if *https != "" { + w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains") + } + h.h.ServeHTTP(w, r) +} + func (h *removeAuthCookieHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { /*var cookies []*http.Cookie for _, c := range r.Cookies() { @@ -1536,7 +1547,7 @@ func main() { }, }}}) server := &http.Server{ - Handler: &loggingHandler{http.NewCrossOriginProtection().Handler(serverMux)}, + Handler: &loggingHandler{http.NewCrossOriginProtection().Handler(&hstsHandler{serverMux})}, ReadHeaderTimeout: 5 * time.Minute, IdleTimeout: 10 * time.Minute, -- cgit v1.3.1