Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2026-05-06 08:37:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add option to enable/disable HSTS

Browse Source 
Also fix HSTS middleware being added twice.
This commit is contained in:
Jimb Esser
2018-08-06 18:24:57 -07:00
committed by Julian Lam
parent 4027abcd58
commit 3cccbbc1f2
3 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/views/admin/settings/advanced.tpl
View File

@@ -67,6 +67,12 @@
<div class="col-sm-2 col-xs-12 settings-header">[[admin/settings/advanced:hsts]]</div>
<div class="col-sm-10 col-xs-12">
<form>
<div class="checkbox">
<label class="mdl-switch mdl-js-switch mdl-js-ripple-effect">
<input class="mdl-switch__input" type="checkbox" data-field="hsts-enabled" checked>
<span class="mdl-switch__label"><strong>[[admin/settings/advanced:hsts.enabled]]</strong></span>
</label>
</div>
<div class="form-group">
<label for="hsts-maxage">[[admin/settings/advanced:hsts.maxAge]]</label>
<input class="form-control" id="hsts-maxage" type="number" placeholder="31536000" data-field="hsts-maxage" /><br />

12
src/webserver.js
View File

@@ -185,13 +185,19 @@ function setupExpressApp(app, callback) {
saveUninitialized: true,
}));
app.use(helmet());
app.use(helmet.referrerPolicy({ policy: 'strict-origin-when-cross-origin' }));
app.use(helmet.hsts({
var hsts_option = {
maxAge: parseInt(meta.config['hsts-maxage'], 10) || 31536000,
includeSubdomains: !!parseInt(meta.config['hsts-subdomains'], 10),
preload: !!parseInt(meta.config['hsts-preload'], 10),
setIf: function () {
// If not set, default to on - previous and recommended behavior
return meta.config['hsts-enabled'] === undefined || !!parseInt(meta.config['hsts-enabled'], 10);
},
};
app.use(helmet({
hsts: hsts_option,
}));
app.use(helmet.referrerPolicy({ policy: 'strict-origin-when-cross-origin' }));
app.use(middleware.addHeaders);
app.use(middleware.processRender);
auth.initialize(app, middleware);