HSTS support

[Ian Young]

I was thinking about supporting HTTP Strict Transport Security on my IdP. I do this elsewhere and it's a fairly simple set-a-header operation in things like Apache.

I'd assume that it's possible to do the same kind of thing with Jetty, and that's one route but I wondered if it was also possible in principle to set the appropriate header in all responses from the IdP by adding something to the web application. That would make it a little easier to turn on for people who were using an embedded container they didn't want to manipulate, such as people using the Windows installer (where the Jetty configuration is replaced on updates).

Any thoughts?

    -- Ian




-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5250 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20150218/a9197971/attachment.bin