AkkomaGang/akkoma
AkkomaGang
/
akkoma
12
63
Fork 83
Code Issues 167 Pull Requests 15 Packages Projects 2 Releases 13 Wiki Activity

Raise HSTS max age to 2 years 

The longer the better, and various HTTP header checkers now suggest a
2 year age.

Signed-off-by: r3g_5z <june@terezi.dev>
This commit is contained in:
r3g_5z 2022-11-19 23:40:36 -05:00
parent 413b40b510
commit 5b9936ce7f
No known key found for this signature in database
3 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
config/config.exs
View File

@ -487,7 +487,7 @@ config :pleroma, Pleroma.Web.Preload,
config :pleroma, :http_security, config :pleroma, :http_security,
enabled: true, enabled: true,
sts: false, sts: false,
sts_max_age: 31_536_000, sts_max_age: 63_072_000,
ct_max_age: 2_592_000, ct_max_age: 2_592_000,
referrer_policy: "same-origin" referrer_policy: "same-origin"

2
config/description.exs
View File

@ -1750,7 +1750,7 @@ config :pleroma, :config_description, [
label: "STS max age", label: "STS max age",
type: :integer, type: :integer,
description: "The maximum age for the Strict-Transport-Security header if sent", description: "The maximum age for the Strict-Transport-Security header if sent",
suggestions: [31_536_000] suggestions: [63_072_000]
}, },
%{ %{
key: :ct_max_age, key: :ct_max_age,

2
docs/docs/installation/openbsd_en.md
View File

@ -167,7 +167,7 @@ http protocol plerup { # Protocol for upstream akkoma server
match response header append "Referrer-Policy" value "same-origin" match response header append "Referrer-Policy" value "same-origin"
match response header append "Content-Security-Policy" value "default-src 'none'; base-uri 'self'; form-action 'self'; img-src 'self' data: https:; media-src 'self' https:; style-src 'self' 'unsafe-inline'; font-src 'self'; script-src 'self'; connect-src 'self' wss://CHANGEME.tld; upgrade-insecure-requests;" # Modify "CHANGEME.tld" and set your instance's domain here match response header append "Content-Security-Policy" value "default-src 'none'; base-uri 'self'; form-action 'self'; img-src 'self' data: https:; media-src 'self' https:; style-src 'self' 'unsafe-inline'; font-src 'self'; script-src 'self'; connect-src 'self' wss://CHANGEME.tld; upgrade-insecure-requests;" # Modify "CHANGEME.tld" and set your instance's domain here
match request header append "Connection" value "upgrade" match request header append "Connection" value "upgrade"
#match response header append "Strict-Transport-Security" value "max-age=31536000; includeSubDomains" # Uncomment this only after you get HTTPS working. #match response header append "Strict-Transport-Security" value "max-age=63072000; includeSubDomains" # Uncomment this only after you get HTTPS working.
# If you do not want remote frontends to be able to access your Akkoma backend server, comment these lines # If you do not want remote frontends to be able to access your Akkoma backend server, comment these lines
match response header append "Access-Control-Allow-Origin" value "*" match response header append "Access-Control-Allow-Origin" value "*"