Add configuration option to enable/disable 'Strict-Transport-Security' HTTP header

2014-09-20 15:35:17 +02:00
parent de225f401d
commit eeb4688dcc
3 changed files with 10 additions and 1 deletions
--- a/app/Controller/Base.php
+++ b/app/Controller/Base.php
@@ -116,9 +116,12 @@ abstract class Base
        $this->response->csp(array('style-src' => "'self' 'unsafe-inline'"));
        $this->response->nosniff();
        $this->response->xss();
-        $this->response->hsts();
        $this->response->xframe();

+        if (ENABLE_HSTS) {
+            $this->response->hsts();
+        }
+
        // Load translations
        $language = $this->config->get('language', 'en_US');
        if ($language !== 'en_US') Translator::load($language);