pr comments

f0ssel · f0ssel · commit 197b16336557 · 2022-03-30T22:21:25.000Z
diff --git a/cli/start.go b/cli/start.go
@@ -47,17 +47,17 @@ func start() *cobra.Command {
 		dev         bool
 		postgresURL string
 		// provisionerDaemonCount is a uint8 to ensure a number > 0.
-		provisionerDaemonCount uint8
-		tlsCertFile            string
-		tlsClientCAFile        string
-		tlsClientAuth          string
-		tlsEnable              bool
-		tlsKeyFile             string
-		tlsMinVersion          string
-		useTunnel              bool
-		traceDatadog           bool
-		hsts                   bool
-		secureCookie           bool
+		provisionerDaemonCount  uint8
+		tlsCertFile             string
+		tlsClientCAFile         string
+		tlsClientAuth           string
+		tlsEnable               bool
+		tlsKeyFile              string
+		tlsMinVersion           string
+		useTunnel               bool
+		traceDatadog            bool
+		strictTransportSecurity bool
+		secureCookie            bool
 	)
 	root := &cobra.Command{
 		Use: "start",
@@ -134,7 +134,7 @@ func start() *cobra.Command {
 				Database:             databasefake.New(),
 				Pubsub:               database.NewPubsubInMemory(),
 				GoogleTokenValidator: validator,
-				HSTS:                 hsts,
+				HSTS:                 strictTransportSecurity,
 				SecureCookie:         secureCookie,
 			}
 
@@ -338,7 +338,7 @@ func start() *cobra.Command {
 	cliflag.BoolVarP(root.Flags(), &useTunnel, "tunnel", "", "CODER_DEV_TUNNEL", true, "Serve dev mode through a Cloudflare Tunnel for easy setup")
 	_ = root.Flags().MarkHidden("tunnel")
 	cliflag.BoolVarP(root.Flags(), &traceDatadog, "trace-datadog", "", "CODER_TRACE_DATADOG", false, "Send tracing data to a datadog agent")
-	cliflag.BoolVarP(root.Flags(), &hsts, "hsts", "", "CODER_HSTS", false, "Set the 'strict-transport-security' header on http responses")
+	cliflag.BoolVarP(root.Flags(), &strictTransportSecurity, "strict-transport-security", "", "CODER_STRICT_TRANSPORT_SECURITY", false, "Set the 'strict-transport-security' header on http responses")
 	cliflag.BoolVarP(root.Flags(), &secureCookie, "secure-cookie", "", "CODER_SECURE_COOKIE", false, "Set the 'Secure' property on browser session cookies")
 
 	return root
diff --git a/coderd/httpmw/hsts.go b/coderd/httpmw/hsts.go
@@ -7,25 +7,25 @@ import (
 )
 
 const (
-	HSTSHeader = "Strict-Transport-Security"
-	HSTSMaxAge = time.Hour * 24 * 365 // 1 year
+	StrictTransportSecurityHeader = "Strict-Transport-Security"
+	StrictTransportSecurityMaxAge = time.Hour * 24 * 365 // 1 year
 )
 
-// HSTS will add the strict-transport-security header if enabled.
+// StrictTransportSecurity will add the strict-transport-security header if enabled.
 // This header forces a browser to always use https for the domain after it loads https
 // once.
 // Meaning: On first load of product.coder.com, they are redirected to https.
 // 		On all subsequent loads, the client's local browser forces https. This prevents man in the middle.
 //
 // This header only makes sense if the app is using tls.
 // Full header example
-//	Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
+//	Strict-Transport-Security: max-age=63072000;
 // nolint:revive
-func HSTS(enable bool) func(next http.Handler) http.Handler {
+func StrictTransportSecurity(enable bool) func(next http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			if enable {
-				w.Header().Set(HSTSHeader, fmt.Sprintf("max-age=%d", int64(HSTSMaxAge)))
+				w.Header().Set(StrictTransportSecurityHeader, fmt.Sprintf("max-age=%d", int64(StrictTransportSecurityMaxAge.Seconds())))
 			}
 
 			next.ServeHTTP(w, r)
diff --git a/coderd/httpmw/hsts_test.go b/coderd/httpmw/hsts_test.go
@@ -6,21 +6,20 @@ import (
 	"net/http/httptest"
 	"testing"
 
+	"github.com/coder/coder/coderd/httpmw"
 	"github.com/go-chi/chi/v5"
 	"github.com/stretchr/testify/require"
-
-	"github.com/coder/coder/coderd/httpmw"
 )
 
-func TestHSTS(t *testing.T) {
+func TestStrictTransportSecurity(t *testing.T) {
 	t.Parallel()
 
 	setup := func(enable bool) *http.Response {
 		rw := httptest.NewRecorder()
 		r := httptest.NewRequest("GET", "/", nil)
 
 		rtr := chi.NewRouter()
-		rtr.Use(httpmw.HSTS(enable))
+		rtr.Use(httpmw.StrictTransportSecurity(enable))
 		rtr.Get("/", func(w http.ResponseWriter, r *http.Request) {
 			_, _ = w.Write([]byte("hello!"))
 		})
@@ -33,13 +32,14 @@ func TestHSTS(t *testing.T) {
 
 		res := setup(true)
 		defer res.Body.Close()
-		require.Contains(t, res.Header.Get(httpmw.HSTSHeader), fmt.Sprintf("max-age=%d", int64(httpmw.HSTSMaxAge)))
+		require.Contains(t, res.Header.Get(httpmw.StrictTransportSecurityHeader), fmt.Sprintf("max-age=%d", int64(httpmw.StrictTransportSecurityMaxAge)))
 	})
 	t.Run("False", func(t *testing.T) {
 		t.Parallel()
 
 		res := setup(false)
 		defer res.Body.Close()
-		require.NotContains(t, res.Header.Get(httpmw.HSTSHeader), fmt.Sprintf("max-age=%d", int64(httpmw.HSTSMaxAge)))
+		require.NotContains(t, res.Header.Get(httpmw.StrictTransportSecurityHeader), fmt.Sprintf("max-age=%d", int64(httpmw.StrictTransportSecurityMaxAge)))
+		require.Equal(t, res.Header.Get(httpmw.StrictTransportSecurityHeader), "")
 	})
 }
