coder
diff --git a/‎cli/start.go
Lines changed: 16 additions & 19 deletions b/‎cli/start.go
Lines changed: 16 additions & 19 deletions
diff --git a/‎coderd/coderd.go
Lines changed: 2 additions & 6 deletions b/‎coderd/coderd.go
Lines changed: 2 additions & 6 deletions
diff --git a/‎coderd/httpmw/stricttransportsecurity.go
Lines changed: 0 additions & 30 deletions b/‎coderd/httpmw/stricttransportsecurity.go
Lines changed: 0 additions & 30 deletions
diff --git a/‎coderd/httpmw/stricttransportsecurity_test.go
Lines changed: 0 additions & 50 deletions b/‎coderd/httpmw/stricttransportsecurity_test.go
Lines changed: 0 additions & 50 deletions
@@ -47,17 +47,16 @@ func start() *cobra.Command {
 		dev         bool
 		postgresURL string
 		// provisionerDaemonCount is a uint8 to ensure a number > 0.
-		provisionerDaemonCount  uint8
-		tlsCertFile             string
-		tlsClientCAFile         string
-		tlsClientAuth           string
-		tlsEnable               bool
-		tlsKeyFile              string
-		tlsMinVersion           string
-		useTunnel               bool
-		traceDatadog            bool
-		strictTransportSecurity bool
-		secureAuthCookie        bool
+		provisionerDaemonCount uint8
+		tlsCertFile            string
+		tlsClientCAFile        string
+		tlsClientAuth          string
+		tlsEnable              bool
+		tlsKeyFile             string
+		tlsMinVersion          string
+		useTunnel              bool
+		traceDatadog           bool
+		secureAuthCookie       bool
 	)
 	root := &cobra.Command{
 		Use: "start",
@@ -129,13 +128,12 @@ func start() *cobra.Command {
 			}
 			logger := slog.Make(sloghuman.Sink(os.Stderr))
 			options := &coderd.Options{
-				AccessURL:               accessURLParsed,
-				Logger:                  logger.Named("coderd"),
-				Database:                databasefake.New(),
-				Pubsub:                  database.NewPubsubInMemory(),
-				GoogleTokenValidator:    validator,
-				StrictTransportSecurity: strictTransportSecurity,
-				SecureAuthCookie:        secureAuthCookie,
+				AccessURL:            accessURLParsed,
+				Logger:               logger.Named("coderd"),
+				Database:             databasefake.New(),
+				Pubsub:               database.NewPubsubInMemory(),
+				GoogleTokenValidator: validator,
+				SecureAuthCookie:     secureAuthCookie,
 			}
 
 			if !dev {
@@ -338,7 +336,6 @@ func start() *cobra.Command {
 	cliflag.BoolVarP(root.Flags(), &useTunnel, "tunnel", "", "CODER_DEV_TUNNEL", true, "Serve dev mode through a Cloudflare Tunnel for easy setup")
 	_ = root.Flags().MarkHidden("tunnel")
 	cliflag.BoolVarP(root.Flags(), &traceDatadog, "trace-datadog", "", "CODER_TRACE_DATADOG", false, "Send tracing data to a datadog agent")
-	cliflag.BoolVarP(root.Flags(), &strictTransportSecurity, "strict-transport-security", "", "CODER_STRICT_TRANSPORT_SECURITY", false, `Specifies if the "strict-transport-security" header is set on http responses`)
 	cliflag.BoolVarP(root.Flags(), &secureAuthCookie, "secure-auth-cookie", "", "CODER_SECURE_AUTH_COOKIE", false, "Specifies if the 'Secure' property is set on browser session cookies")
 
 	return root
 
@@ -30,8 +30,7 @@ type Options struct {
 	AWSCertificates      awsidentity.Certificates
 	GoogleTokenValidator *idtoken.Validator
 
-	StrictTransportSecurity bool
-	SecureAuthCookie        bool
+	SecureAuthCookie bool
 }
 
 // New constructs the Coder API into an HTTP handler.
@@ -48,10 +47,7 @@ func New(options *Options) (http.Handler, func()) {
 
 	r := chi.NewRouter()
 	r.Route("/api/v2", func(r chi.Router) {
-		r.Use(
-			chitrace.Middleware(),
-			httpmw.StrictTransportSecurity(api.StrictTransportSecurity),
-		)
+		r.Use(chitrace.Middleware())
 		r.Get("/", func(w http.ResponseWriter, r *http.Request) {
 			httpapi.Write(w, http.StatusOK, httpapi.Response{
 				Message: "👋",