AkkomaGang/akkoma
AkkomaGang
/
akkoma
12
63
Fork 83
Code Issues 174 Pull Requests 18 Packages Projects 2 Releases 12 Wiki Activity

Directly specify preload for Strict-Transport-Security 

For most browsers, this is usually implied by the header itself,
however for HSTS to be effective you need to submit your root domain to
hstspreload.org. If "preload" is not in the header, it will reject your
domain.

Signed-off-by: r3g_5z <june@terezi.dev>
This commit is contained in:
r3g_5z 2022-11-19 23:48:49 -05:00
parent 828e0f56c5
commit c08ee3edb2
No known key found for this signature in database
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
docs/docs/installation/openbsd_en.md
View File

@ -167,7 +167,7 @@ http protocol plerup { # Protocol for upstream akkoma server
match response header append "Referrer-Policy" value "same-origin"
match response header append "Content-Security-Policy" value "default-src 'none'; base-uri 'self'; form-action 'self'; img-src 'self' data: https:; media-src 'self' https:; style-src 'self' 'unsafe-inline'; font-src 'self'; script-src 'self'; connect-src 'self' wss://CHANGEME.tld; upgrade-insecure-requests;" # Modify "CHANGEME.tld" and set your instance's domain here
match request header append "Connection" value "upgrade"
#match response header append "Strict-Transport-Security" value "max-age=63072000; includeSubDomains" # Uncomment this only after you get HTTPS working.
#match response header append "Strict-Transport-Security" value "max-age=63072000; includeSubDomains; preload" # Uncomment this only after you get HTTPS working.
# If you do not want remote frontends to be able to access your Akkoma backend server, comment these lines
match response header append "Access-Control-Allow-Origin" value "*"

2
lib/pleroma/web/plugs/http_security_plug.ex
View File

@ -238,7 +238,7 @@ your instance and your users via malicious posts:
max_age_sts = Config.get([:http_security, :sts_max_age])
merge_resp_headers(conn, [
{"strict-transport-security", "max-age=#{max_age_sts}; includeSubDomains"}
{"strict-transport-security", "max-age=#{max_age_sts}; includeSubDomains; preload"}
])
end