Merge "Bug 1734767: Add HTTP Strict Transport Security (HSTS) header"

6c54a4ab · Robert Lyon · Gerrit Code Review · 287814bc · 56ff87df · 6c54a4ab
Commit 6c54a4ab authored Jan 17, 2018 by Robert Lyon Committed by Gerrit Code Review Jan 17, 2018
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 1 deletion

htdocs/init.php htdocs/init.php +3 -1

No files found.
--- a/htdocs/init.php
+++ b/htdocs/init.php
@@ -359,7 +359,9 @@ if (!defined('CLI')) {
    header('X-XSS-Protection: 1; mode=block');
    header('X-Content-Type-Options: nosniff');
    header('X-Permitted-Cross-Domain-Policies: master-only');
-
+    if (is_https()) {
+        header('Strict-Transport-Security: max-age=63072000');
+    }
    // Don't print precise PHP version as an HTTP header
    header_remove('x-powered-by');
 }