Adds HSTS configuration variables

[austinpray]

Adds the following WordPress site variables

ssl.nginx_hsts_max_age
ssl.nginx_hsts_include_subdomains
ssl.nginx_hsts_preload

Adds the following nginx global defaults

nginx_hsts_max_age: 31536000
nginx_hsts_include_subdomains: true
nginx_hsts_preload: true

[louim]

Any particular reason why we would want these options to be configurable vs enforcing them as sane defaults?

[retlehs]

i ran into an issue today where includeSubDomains affected subdomains and made them inaccessible, had to remove it and set the max-age to 0

https://shrikantadhikarla.wordpress.com/2013/02/18/anatomy-of-includesubdomains-directive-in-http-strict-transport-security-policy/

[austinpray]

@louim if you need to refresh your settings you might need to set max_age to 0 temporarily

Whenever the Strict-Transport-Security header is delivered to the browser, it will update the expiration time for that site, so sites can refresh this information and prevent the timeout from expiring. Should it be necessary to disable Strict Transport Security, setting the max-age to 0 (over a https connection) will immediately expire the Strict-Transport-Security header, allowing access via http.

https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security

Also, mind as well keep them configurable since these are potentially site-breaking options

[swalkinshaw]

do we care how messy this is? If the variables were strings it could be:

add_header Strict-Transport-Security "max-age={{ [hsts_max_age, hsts_include_subdomains, hsts_preload].join(';') }}";

[austinpray]

The reason why I did the manual "; " prefix is because I was trying to follow the format:

https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security#Enabling_Strict_Transport_Security

Other formatting examples

https://tools.ietf.org/html/draft-hodges-strict-transport-sec-02#page-14

https://www.owasp.org/index.php/HTTP_Strict_Transport_Security

[austinpray]

results in add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";

[swalkinshaw]

@austinpray changelog pls 🍉

[austinpray]

@roots/trellis-contributors gimme a couple extra go-aheads and I'll merge.

[swalkinshaw]

👍

[louim]

👍