Send HSTS on HTTPS pages.

session.lib.php

@@ -10,6 +10,8 @@ header('X-Frame-Options: DENY');
 header("Content-Security-Policy: frame-ancestors 'none'");
 
 if (isset($_SERVER['HTTPS'])) {
+  // Browsers use HTTPS for this host for a year, without a plain request first
+  header('Strict-Transport-Security: max-age=31536000');
   session_cache_limiter('private');
   session_set_cookie_params(array('lifetime' => 0, 'path' => '/', 'domain' => cookie_domain(), 'secure' => TRUE, 'httponly' => TRUE, 'samesite' => 'Lax'));
   session_start();

tests/php/Pages/FrontPagesTest.php

@@ -49,6 +49,14 @@ class FrontPagesTest extends PageTestCase {
     $this->assertSame('DENY', $this->header($this->get('/', array('X-Test-Plain' => '1')), 'X-Frame-Options'));
   }
 
+  // Browsers then use HTTPS for a year, so nobody can catch the first plain request
+  public function testHttpsPagesSendHsts(): void {
+    foreach (array('/', '/publish', '/publish/login') as $path)
+      $this->assertSame('max-age=31536000', $this->header($this->get($path), 'Strict-Transport-Security'), $path);
+    // Browsers ignore the header over plain HTTP
+    $this->assertNull($this->header($this->get('/', array('X-Test-Plain' => '1')), 'Strict-Transport-Security'));
+  }
+
   public function testPlainHttpStartsNoSession(): void {
     $page = $this->get('/', array('X-Test-Plain' => '1'));
     $this->assertSame(200, $page['status']);