HSTS settings. Fixes issue w3c#1.

lgarron · Oct 8, 2014 · 0957f2a · 0957f2a
1 parent d6d18b3
commit 0957f2a
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 4 deletions.
diff --git a/index.html b/index.html
@@ -5,6 +5,12 @@
 <head>
   <link type="text/css" rel="stylesheet" href="/static/main.css" />
   <script>
+    function resetURL(age) {
+      window.location.href = "//{{ host }}/";
+    }
+    function setHSTSMaxAge(age) {
+      window.location.href = "?hsts-max-age=" + age;
+    }
     function loadPage(protocol) {
       var url = protocol + "://{{ host }}/";
       window.location.href = url;
@@ -34,6 +40,7 @@
 
   Mixed Content Test Site
 
+
   <br><br>
 
   <button onclick="loadPage('http')" class="http">HTTP Page</button>
@@ -60,6 +67,13 @@
   <div id="messages">Script Messages go here:<br></div>
 
 </div>
+<div class="section">
+  {{ hsts_message }}<br><br>
+  <button onclick="setHSTSMaxAge(0)">max-age=0</button>
+  <button onclick="setHSTSMaxAge(60)">max-age=60</button>
+  <button onclick="setHSTSMaxAge(10886400)">max-age=10886400</button>
+  <button onclick="resetURL()">Reset URL</button>
+</div>
 
 </body>
 </html>

diff --git a/mixed-content-test.py b/mixed-content-test.py
@@ -21,14 +21,23 @@ def get(self):
 
         protocol = "https" if (os.environ['HTTPS'] == "on") else "http"
 
+        if self.request.get("hsts-max-age"):
+            try:
+                hsts_max_age = int(self.request.get("hsts-max-age"))
+                self.response.headers['Strict-Transport-Security'] = ('max-age=%d' % hsts_max_age)
+                hsts_message = ("HSTS max-age sent: %d" % hsts_max_age)
+            except Exception:
+                self.response.headers['Strict-Transport-Security'] = 'invalid request'
+                hsts_message = "Invalid HSTS max-age requested."
+        else:
+            hsts_message = "HSTS"
+
         template_values = {
             "protocol": protocol,
-            "host": os.environ['HTTP_HOST']
+            "host": os.environ['HTTP_HOST'],
+            "hsts_message": hsts_message
         }
 
-        if os.environ['HTTP_HOST'].startswith("hsts."):
-            self.response.headers['Strict-Transport-Security'] = 'max-age=300'
-
         template = JINJA_ENVIRONMENT.get_template('index.html')
         self.response.write(template.render(template_values))