From: Silvio Rhatto <rhatto@riseup.net>
Date: Mon, 5 Dec 2011 20:34:28 +0000 (-0200)
Subject: HSTS support
X-Git-Url: https://gitweb.fluxo.info/?a=commitdiff_plain;h=f690c065246f1a31e732c0a24100401e58a1adb2;p=puppet-apache.git

HSTS support
---

diff --git a/templates/site.erb b/templates/site.erb
index 25dd22d..246e616 100644
--- a/templates/site.erb
+++ b/templates/site.erb
@@ -4,8 +4,12 @@
 <% if server_alias != false %>   ServerAlias <%= server_alias %><% end %>
    DocumentRoot <%= docroot %>
  <% if https_redirect != false %>
+    # Use HTTP Strict Transport Security to force client to use secure connections only
+    Header always set Strict-Transport-Security "max-age=15768000; includeSubDomains"
+
+    # Redirect all HTTP to HTTPS
     RewriteEngine On
-    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
+    RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [redirect=301]
 <% if redirect_match != false %>   RedirectMatch ^/$ <%= protocol %>://<%= title %>.<%= hosting_domain %>/<%= redirect_match %><% end %>
 <% if redirect != false %>   Redirect <%= redirect %><% end %>
 <% if aliases != false %><% aliases.each do |map| -%>