Merge pull request #402 from jrafanie/set-hsts-by-default

Set hsts by default

Author: Fryguy

COPY/etc/httpd/conf.d/manageiq-https-application.conf

@@ -12,6 +12,7 @@ Include conf.d/manageiq-redirects-ui
 Include conf.d/manageiq-redirects-websocket
 Include conf.d/manageiq-host-config
 RequestHeader set X_FORWARDED_PROTO 'https'
+Header always set Strict-Transport-Security "max-age=631138519"
 
 ErrorLog /var/www/miq/vmdb/log/apache/ssl_error.log
 TransferLog /var/www/miq/vmdb/log/apache/ssl_access.log
@@ -22,8 +23,10 @@ SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
 SSLCertificateFile /var/www/miq/vmdb/certs/server.cer
 SSLCertificateKeyFile /var/www/miq/vmdb/certs/server.cer.key
 
-<Location /assets/>
+<LocationMatch "^/(assets|packs)/">
   Header unset ETag
+  # Explicit HSTS needed: Location blocks using "Header set" don't inherit "Header always set" from VirtualHost
+  Header always set Strict-Transport-Security   "max-age=631138519"
   Header set Content-Security-Policy            "default-src 'self'; child-src 'self'; connect-src 'self'; font-src 'self' fonts.gstatic.com; script-src 'self'; style-src 'self'; report-uri /dashboard/csp_report"
   Header set X-Content-Type-Options             "nosniff"
   Header set X-Frame-Options                    "SAMEORIGIN"
@@ -33,20 +36,7 @@ SSLCertificateKeyFile /var/www/miq/vmdb/certs/server.cer.key
   Header merge Cache-Control public
   ExpiresActive On
   ExpiresDefault "access plus 1 year"
-</Location>
-
-<Location /packs/>
-  Header unset ETag
-  Header set Content-Security-Policy            "default-src 'self'; child-src 'self'; connect-src 'self'; font-src 'self' fonts.gstatic.com; script-src 'self'; style-src 'self'; report-uri /dashboard/csp_report"
-  Header set X-Content-Type-Options             "nosniff"
-  Header set X-Frame-Options                    "SAMEORIGIN"
-  Header set X-Permitted-Cross-Domain-Policies  "none"
-  Header set X-XSS-Protection                   "1; mode=block"
-  FileETag None
-  Header merge Cache-Control public
-  ExpiresActive On
-  ExpiresDefault "access plus 1 year"
-</Location>
+</LocationMatch>
 
 <Files ~ "\.(cgi|shtml|phtml|php3?)$">
   SSLOptions +StdEnvVars