Secure Headers #415

icco · 2020-08-28T22:32:19Z

Proposed Changes

Removes HSTS header and migrates to using a common package for all things secure headers
https://securityheaders.com/ -> Promotes us from an F/D to C
Adds automatic HTTPS redirect
Fixes Redirect all GCLB URLs to HTTPS #362 also is a replacement for Add HSTS middleware #381.

Release Note

Adds a variety of best practice security headers to all three servers.

sethvargo

/lgtm

google-oss-robot · 2020-08-28T22:36:51Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: icco, sethvargo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

icco added 5 commits August 28, 2020 16:22

Add common security settings handler

d1206dc

remove old hsts middleware

cbf62e7

go mod update

118158a

change to a bool

d658a22

lint fix

5037eee

google-oss-robot requested review from mikehelmick and sethvargo August 28, 2020 22:32

google-oss-robot added the approved label Aug 28, 2020

googlebot added the cla: yes Auto: added by CLA bot when all committers have signed a CLA. label Aug 28, 2020

google-oss-robot added the size/L label Aug 28, 2020

sethvargo approved these changes Aug 28, 2020

View reviewed changes

google-oss-robot assigned sethvargo Aug 28, 2020

google-oss-robot added the lgtm label Aug 28, 2020

google-oss-robot merged commit ba3a6a6 into google:main Aug 28, 2020

icco deleted the secure branch September 1, 2020 11:35

google locked and limited conversation to collaborators Oct 6, 2020

icco restored the secure branch October 6, 2020 20:52

icco deleted the secure branch October 6, 2020 21:22