Software /
code /
prosody-modules
File
mod_strict_https/mod_strict_https.lua @ 5733:15c1801e8901
mod_audit: Fix showing session details in module command
The namespaced session element was not accounted for.
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Mon, 13 Nov 2023 12:37:21 +0100 |
parent | 5415:f8797e3284ff |
line wrap: on
line source
-- HTTP Strict Transport Security -- https://www.rfc-editor.org/info/rfc6797 module:set_global(); local http_server = require "net.http.server"; local hsts_header = module:get_option_string("hsts_header", "max-age=31556952"); -- This means "Don't even try to access without HTTPS for a year" local redirect = module:get_option_boolean("hsts_redirect", true); module:wrap_object_event(http_server._events, false, function(handlers, event_name, event_data) local request, response = event_data.request, event_data.response; if request and response then if request.secure then response.headers.strict_transport_security = hsts_header; elseif redirect then -- This won't get the port number right response.headers.location = "https://" .. request.host .. request.path .. (request.query and "?" .. request.query or ""); return 301; end end return handlers(event_name, event_data); end);