diff --git a/public/language/en-GB/admin/settings/advanced.json b/public/language/en-GB/admin/settings/advanced.json index 16eae5a8bd..e4070ab7be 100644 --- a/public/language/en-GB/admin/settings/advanced.json +++ b/public/language/en-GB/admin/settings/advanced.json @@ -12,6 +12,10 @@ "headers.acac": "Access-Control-Allow-Credentials", "headers.acam": "Access-Control-Allow-Methods", "headers.acah": "Access-Control-Allow-Headers", + "hsts": "Strict Transport Security", + "hsts.subdomains": "Include subdomains in HSTS header", + "hsts.preload": "Allow preloading of HSTS header", + "hsts.help": "An HSTS header is already pre-configured for this site. You can elect to include subdomains and preloading flags in your header. If in doubt, you can leave these unchecked. More information ", "traffic-management": "Traffic Management", "traffic.help": "NodeBB deploys equipped with a module that automatically denies requests in high-traffic situations. You can tune these settings here, although the defaults are a good starting point.", "traffic.enable": "Enable Traffic Management", diff --git a/src/views/admin/settings/advanced.tpl b/src/views/admin/settings/advanced.tpl index 958ae73c3f..44d34fa80f 100644 --- a/src/views/admin/settings/advanced.tpl +++ b/src/views/admin/settings/advanced.tpl @@ -63,6 +63,33 @@ +
+
[[admin/settings/advanced:hsts]]
+
+
+
+ +
+
+
+ +
+
+ +
+

+ [[admin/settings/advanced:hsts.help, https:\/\/hstspreload.org\/]] +

+
+
+
+
[[admin/settings/advanced:traffic-management]]
diff --git a/src/webserver.js b/src/webserver.js index 89e710c9c2..be4c02f443 100644 --- a/src/webserver.js +++ b/src/webserver.js @@ -195,6 +195,11 @@ function setupExpressApp(app, callback) { app.use(helmet()); app.use(helmet.referrerPolicy({ policy: 'strict-origin-when-cross-origin' })); + app.use(helmet.hsts({ + maxAge: parseInt(meta.config['hsts-maxage'], 10) || 31536000, + includeSubdomains: !!parseInt(meta.config['hsts-subdomains'], 10), + preload: !!parseInt(meta.config['hsts-preload'], 10), + })); app.use(middleware.addHeaders); app.use(middleware.processRender); auth.initialize(app, middleware);