fix: hsts

Author: mklos-kw

changelog/unreleased/http_strict_transport_security.md

@@ -0,0 +1,5 @@
+Enhancement: HTTP Strict Transport Security
+
+Added Support for HTTP Strict Transport Security. It reduces surface for Man-in-the-Middle attacks or leakage of sensitive information.
+
+https://github.com/owncloud/ocis/pull/11568

services/proxy/pkg/middleware/security.go

@@ -62,6 +62,7 @@ func Security(cspConfig *config.CSP) func(h http.Handler) http.Handler {
 		FrameDeny:                    true,
 		ReferrerPolicy:               "strict-origin-when-cross-origin",
 		STSSeconds:                   315360000,
+		STSIncludeSubdomains:         true,
 		STSPreload:                   true,
 		PermittedCrossDomainPolicies: "none",
 		RobotTag:                     "none",

services/proxy/pkg/middleware/security_test.go

@@ -1,8 +1,12 @@
 package middleware
 
 import (
-	"gotest.tools/v3/assert"
+	"net/http"
+	"net/http/httptest"
 	"testing"
+
+	"github.com/owncloud/ocis/v2/services/proxy/pkg/config"
+	"gotest.tools/v3/assert"
 )
 
 func TestLoadCSPConfig(t *testing.T) {
@@ -25,3 +29,34 @@ directives:
 	assert.Equal(t, config.Directives["frame-src"][2], "https://onlyoffice.owncloud.test/")
 	assert.Equal(t, config.Directives["frame-src"][3], "https://collabora.owncloud.test/")
 }
+
+func TestStrictTransportSecurity(t *testing.T) {
+	// Create test handler
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+
+	// Use production security middleware config
+	cspConfig := &config.CSP{
+		Directives: map[string][]string{
+			"default-src": {"'none'"},
+		},
+	}
+	securityMiddleware := Security(cspConfig)
+
+	// Test HTTPS request, url not important, only headers will be checked
+	req, err := http.NewRequest("GET", "https://example.com", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("X-Forwarded-Proto", "https")
+
+	rr := httptest.NewRecorder()
+	securityMiddleware(handler).ServeHTTP(rr, req)
+
+	hstsHeader := rr.Header().Get("Strict-Transport-Security")
+
+	// HSTS header should contain includeSubDomains
+	expected := "max-age=315360000; includeSubDomains; preload"
+	assert.Equal(t, hstsHeader, expected, "HSTS header missing includeSubDomains directive - subdomains not protected")
+}