search

18F / ekip

Every Kid in a Park
Other
1 stars 3 forks source link

HSTS includeSubDomains and preload policy #163

Open konklone opened 9 years ago

konklone commented 9 years ago

As recommended by OMB, for a second-level domain like everykidsinapark.gov, it's preferable (and awesome) to add an HSTS policy of:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

It's important for this policy to appear on the root https://everykidinapark.gov, and not only on the www subdomain.

The current policy is our Cloud Foundry default, which lacks the ; includeSubDomains; preload part. Cloud Foundry is designed to pass on an app's own HSTS policy if it sets one itself, so an override by EKIP will show up on the public internet.

konklone commented 9 years ago

Ping! Now that the site's launched and stable, is this a header we can get onto the site? Is that something I can be helpful with?