[java-identity-provider] branch master updated: IDP-627 - Support HSTS, CSP, X-Frame-Options, etc.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=04a6cc3b8cd75f7339761f616e3111349557256e

The following commit(s) were added to refs/heads/master by this push:
       new  04a6cc3   IDP-627 - Support HSTS, CSP, X-Frame-Options, etc.
04a6cc3 is described below

commit 04a6cc3b8cd75f7339761f616e3111349557256e
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Sep 12 09:56:05 2018 -0400

    IDP-627 - Support HSTS, CSP, X-Frame-Options, etc.
    
    https://issues.shibboleth.net/jira/browse/IDP-627
    
    Adjust HSTS property so the header can be omitted.
---
 idp-conf/src/main/resources/conf/idp.properties           | 4 ++--
 idp-conf/src/main/resources/system/conf/global-system.xml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/idp-conf/src/main/resources/conf/idp.properties b/idp-conf/src/main/resources/conf/idp.properties
index 3768496..b5625cb 100644
--- a/idp-conf/src/main/resources/conf/idp.properties
+++ b/idp-conf/src/main/resources/conf/idp.properties
@@ -25,8 +25,8 @@ idp.scope = example.org
 #idp.cookie.path =
 #idp.cookie.maxAge = 31536000
 
-# HSTS response header policy
-#idp.hsts.maxAge = 0
+# HSTS/CSP response headers
+#idp.hsts = max-age=0
 # X-Frame-Options value, set to DENY or SAMEORIGIN to block framing
 #idp.frameoptions = DENY
 # Content-Security-Policy value, set to match X-Frame-Options default
diff --git a/idp-conf/src/main/resources/system/conf/global-system.xml b/idp-conf/src/main/resources/system/conf/global-system.xml
index 0ddcf33..ecc2675 100644
--- a/idp-conf/src/main/resources/system/conf/global-system.xml
+++ b/idp-conf/src/main/resources/system/conf/global-system.xml
@@ -171,7 +171,7 @@
             class="org.springframework.beans.factory.config.MapFactoryBean">
         <property name="sourceMap">
             <map>
-                <entry key="Strict-Transport-Security" value="max-age=%{idp.hsts.maxAge:0}" />
+                <entry key="Strict-Transport-Security" value="%{idp.hsts:max-age=0}" />
                 <entry key="X-Frame-Options" value="%{idp.frameoptions:DENY}" />
                 <entry key="Content-Security-Policy" value="%{idp.csp:frame-ancestors 'none';}"/>
             </map>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.