Send HSTS on HTTPS pages.

2026-09-26 15:27:51 +02:00
parent b6a1eff3e6
commit 30b275b902
2 changed files with 10 additions and 0 deletions
@@ -49,6 +49,14 @@ class FrontPagesTest extends PageTestCase {
    $this->assertSame('DENY', $this->header($this->get('/', array('X-Test-Plain' => '1')), 'X-Frame-Options'));
  }

+  // Browsers then use HTTPS for a year, so nobody can catch the first plain request
+  public function testHttpsPagesSendHsts(): void {
+    foreach (array('/', '/publish', '/publish/login') as $path)
+      $this->assertSame('max-age=31536000', $this->header($this->get($path), 'Strict-Transport-Security'), $path);
+    // Browsers ignore the header over plain HTTP
+    $this->assertNull($this->header($this->get('/', array('X-Test-Plain' => '1')), 'Strict-Transport-Security'));
+  }
+
  public function testPlainHttpStartsNoSession(): void {
    $page = $this->get('/', array('X-Test-Plain' => '1'));
    $this->assertSame(200, $page['status']);