gnu-social/plugins/StrictTransportSecurity
Diogo Peralta Cordeiro 6e031d623a [VersionBump] 2.0.0beta0
Updated composer and translations

composer install --no-dev
composer dump-autoload --optimize
git add vendor/ --force
make updatepo
2021-07-18 12:49:17 +01:00
..
locale [VersionBump] 2.0.0beta0 2021-07-18 12:49:17 +01:00
README Either use or don't use HTTPS 2016-02-10 00:57:39 +01:00
StrictTransportSecurityPlugin.php [CORE] Add GNUSOCIAL_ENGINE_REPO_URL and increase usage of GNUSOCIAL_ENGINE_URL 2021-07-16 19:44:36 +01:00

The Strict Transport Security plugin implements the Strict Transport Security header, improving the security of HTTPS only sites.
See http://lists.w3.org/Archives/Public/www-archive/2009Sep/att-0051/draft-hodges-strict-transport-sec-05.plain.html for the specification.

Installation
============
add "addPlugin('strictTransportSecurity');"
to the bottom of your config.php

The plugin will not do anything unless:
$config['site']['ssl'] is set to something other than 'never'
$config['site']['path'] is either not set, empty, or '/'

Settings
========
max_age (15552000): sets how long to remember the forced HTTPS (seconds) (15552000 seconds is 180 days)
includeSubDomains (false): if set, then STS will apply to all the sub-domains too.

Example
=======
addPlugin('strictTransportSecurity');