support hsts

Author: lunny

modules/setting/hsts.go

@@ -0,0 +1,34 @@
+// Copyright 2019 The Gitea Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package setting
+
+import "time"
+
+const (
+	defaultMaxAge = time.Hour * 24 * 365
+)
+
+// HSTS is the configuration of HSTS
+var HSTS = struct {
+	Enabled              bool
+	MaxAge               time.Duration
+	SendPreloadDirective bool
+}{
+	Enabled:              false,
+	MaxAge:               defaultMaxAge,
+	SendPreloadDirective: false,
+}
+
+func configHSTS() {
+	sec := Cfg.Section("hsts")
+	// Check mailer setting.
+	if !sec.Key("ENABLED").MustBool() {
+		return
+	}
+
+	HSTS.Enabled = true
+	HSTS.MaxAge = sec.Key("MAX_AGE").MustDuration(defaultMaxAge)
+	HSTS.SendPreloadDirective = sec.Key("SEND_PRELOAD_DIRECTIVE").MustBool()
+}

modules/setting/setting.go

@@ -910,6 +910,7 @@ func NewContext() {
 
 	newCron()
 	newGit()
+	configHSTS()
 
 	sec = Cfg.Section("mirror")
 	Mirror.MinInterval = sec.Key("MIN_INTERVAL").MustDuration(10 * time.Minute)

routers/routes/routes.go

@@ -10,6 +10,7 @@ import (
 	"net/http"
 	"os"
 	"path"
+	"strconv"
 	"text/template"
 	"time"
 
@@ -102,6 +103,16 @@ func RouterHandler(level log.Level) func(ctx *macaron.Context) {
 	}
 }
 
+func createHeaderValueNew(maxAge time.Duration, sendPreloadDirective bool) string {
+	buf := bytes.NewBufferString("max-age=")
+	buf.WriteString(strconv.Itoa(int(maxAge.Seconds())))
+	buf.WriteString("; includeSubDomains")
+	if sendPreloadDirective {
+		buf.WriteString("; preload")
+	}
+	return buf.String()
+}
+
 // NewMacaron initializes Macaron instance.
 func NewMacaron() *macaron.Macaron {
 	gob.Register(&u2f.Challenge{})
@@ -131,6 +142,13 @@ func NewMacaron() *macaron.Macaron {
 	if setting.Protocol == setting.FCGI {
 		m.SetURLPrefix(setting.AppSubURL)
 	}
+	if setting.HSTS.Enabled {
+		m.Use(func() macaron.Handler {
+			return func(ctx *macaron.Context) {
+				ctx.Resp.Header().Set("Strict-Transport-Security", createHeaderValueNew(setting.HSTS.MaxAge, setting.HSTS.SendPreloadDirective))
+			}
+		})
+	}
 	m.Use(public.Custom(
 		&public.Options{
 			SkipLogging:  setting.DisableRouterLog,