[java-identity-provider] branch main updated: IDP-2064 - Tighten header defaults in next major release

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=df80877751730b7dc033d8671a34ca3919a0422f

The following commit(s) were added to refs/heads/main by this push:
     new df8087775 IDP-2064 - Tighten header defaults in next major release
df8087775 is described below

commit df80877751730b7dc033d8671a34ca3919a0422f
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Apr 18 11:25:04 2023 -0400

    IDP-2064 - Tighten header defaults in next major release
    
    https://shibboleth.atlassian.net/browse/IDP-2064
    
    Change HSTS default to a year.
---
 idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/filters.xml | 2 +-
 idp-conf/src/main/resources/conf/idp.properties                      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/filters.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/filters.xml
index 3bad77fe3..5185d84d5 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/filters.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/filters.xml
@@ -21,7 +21,7 @@
             class="org.springframework.beans.factory.config.MapFactoryBean">
         <property name="sourceMap">
             <map>
-                <entry key="Strict-Transport-Security" value="%{idp.hsts:max-age=0}" />
+                <entry key="Strict-Transport-Security" value="%{idp.hsts:max-age=31536000}" />
                 <entry key="X-Frame-Options" value="%{idp.frameoptions:DENY}" />
                 <entry key="Content-Security-Policy" value="%{idp.csp:frame-ancestors 'none';}"/>
             </map>
diff --git a/idp-conf/src/main/resources/conf/idp.properties b/idp-conf/src/main/resources/conf/idp.properties
index c6765a694..ec4833001 100644
--- a/idp-conf/src/main/resources/conf/idp.properties
+++ b/idp-conf/src/main/resources/conf/idp.properties
@@ -38,7 +38,7 @@ idp.csrf.enabled = true
 #idp.csrf.token.parameter = csrf_token
 
 # HSTS/CSP response headers
-#idp.hsts = max-age=0
+#idp.hsts = max-age=31536000
 # X-Frame-Options value, set to DENY or SAMEORIGIN to block framing
 #idp.frameoptions = DENY
 # Content-Security-Policy value, set to match X-Frame-Options default

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.