From f4f216db67e2a02ed8f5057d8a74f77cf2fc8ab2 Mon Sep 17 00:00:00 2001 From: Stan Hu Date: Sun, 12 Jul 2015 21:37:10 -0700 Subject: [PATCH] Only enable HSTS header for HTTPS and port 443 Closes https://github.com/gitlabhq/gitlabhq/issues/9449 --- CHANGELOG | 1 + app/controllers/application_controller.rb | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/CHANGELOG b/CHANGELOG index 7d5f186d75..e95c72790d 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,6 +1,7 @@ Please view this file on the master branch, on stable branches it's out of date. v 7.13.0 (unreleased) + - Only enable HSTS header for HTTPS and port 443 (Stan Hu) - Fix user autocomplete for unauthenticated users accessing public projects (Stan Hu) - Fix redirection to home page URL for unauthorized users (Daniel Gerhardt) - Add branch switching support for graphs (Daniel Gerhardt) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 8a9d0ce6ff..362b03e0d5 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -183,7 +183,10 @@ class ApplicationController < ActionController::Base headers['X-XSS-Protection'] = '1; mode=block' headers['X-UA-Compatible'] = 'IE=edge' headers['X-Content-Type-Options'] = 'nosniff' - headers['Strict-Transport-Security'] = 'max-age=31536000' if Gitlab.config.gitlab.https + # Enabling HSTS for non-standard ports would send clients to the wrong port + if Gitlab.config.gitlab.https and Gitlab.config.gitlab.port == 443 + headers['Strict-Transport-Security'] = 'max-age=31536000' + end end def add_gon_variables