search

YunoHost / packages_old

[not used anymore] YunoHost Debian package sources
http://yunohost.org
8 stars 7 forks source link

Strict-Transport-Security should not include subdomains #28

Closed opi closed 10 years ago

opi commented 10 years ago

https://github.com/YunoHost/packages/blob/master/yunohost-config-nginx/config/template.conf#L30

add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

Because in YNH, any subdomain (ex: mail.example.org) is considered as a separate domain, HSTS directive should not force includeSubdomains.

Kloadut commented 10 years ago

+1