opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: Add option to enable hsts header (#6147)

Browse Source 
* feat: Add option to enable hsts header
* Update golden files
This commit is contained in:
Steven Masley
2023-02-10 10:52:49 -06:00
committed by GitHub
parent 77afdf71dc
commit 6189035e98
13 changed files with 287 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cli/deployment/config.go
+14
View File
@@ -374,6 +374,20 @@ func newConfig() *codersdk.DeploymentConfig {
Usage: "Controls if the 'Secure' property is set on browser session cookies.",
Flag: "secure-auth-cookie",
},
StrictTransportSecurity: &codersdk.DeploymentConfigField[int]{
Name: "Strict-Transport-Security",
Usage: "Controls if the 'Strict-Transport-Security' header is set on all static file responses. " +
"This header should only be set if the server is accessed via HTTPS. This value is the MaxAge in seconds of " +
"the header.",
Default: 0,
Flag: "strict-transport-security",
},
StrictTransportSecurityOptions: &codersdk.DeploymentConfigField[[]string]{
Name: "Strict-Transport-Security Options",
Usage: "Two optional fields can be set in the Strict-Transport-Security header; 'includeSubDomains' and 'preload'. " +
"The 'strict-transport-security' flag must be set to a non-zero value for these options to be used.",
Flag: "strict-transport-security-options",
},
SSHKeygenAlgorithm: &codersdk.DeploymentConfigField[string]{
Name: "SSH Keygen Algorithm",
Usage: "The algorithm to use for generating ssh keys. Accepted values are \"ed25519\", \"ecdsa\", or \"rsa4096\".",
cli/server.go
+7
View File
@@ -485,6 +485,13 @@ func Server(vip *viper.Viper, newAPI func(context.Context, *coderd.Options) (*co
options.TLSCertificates = tlsConfig.Certificates
}
if cfg.StrictTransportSecurity.Value > 0 {
options.StrictTransportSecurityCfg, err = httpmw.HSTSConfigOptions(cfg.StrictTransportSecurity.Value, cfg.StrictTransportSecurityOptions.Value)
if err != nil {
return xerrors.Errorf("coderd: setting hsts header failed (options: %v): %w", cfg.StrictTransportSecurityOptions.Value, err)
}
}
if cfg.UpdateCheck.Value {
options.UpdateCheckOptions = &updatecheck.Options{
// Avoid spamming GitHub API checking for updates.
cli/testdata/coder_server_--help.golden
Vendored
+17
View File
@@ -280,6 +280,23 @@ Flags:
"ed25519", "ecdsa", or "rsa4096".
Consumes $CODER_SSH_KEYGEN_ALGORITHM
(default "ed25519")
--strict-transport-security int Controls if the
'Strict-Transport-Security' header
is set on all static file responses.
This header should only be set if
the server is accessed via HTTPS.
This value is the MaxAge in seconds
of the header.
Consumes $CODER_STRICT_TRANSPORT_SECURITY
--strict-transport-security-options strings Two optional fields can be set in
the Strict-Transport-Security
header; 'includeSubDomains' and
'preload'. The
'strict-transport-security' flag
must be set to a non-zero value for
these options to be used.
Consumes
$CODER_STRICT_TRANSPORT_SECURITY_OPTIONS
--swagger-enable Expose the swagger endpoint via
/swagger.
Consumes $CODER_SWAGGER_ENABLE