Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IIS 7.0+ example HSTS fix #238

Merged
merged 2 commits into from
Nov 20, 2017
Merged

IIS 7.0+ example HSTS fix #238

merged 2 commits into from
Nov 20, 2017

Conversation

bandrzej
Copy link
Contributor

@bandrzej bandrzej commented Nov 9, 2017

Submitted edit prevents HSTS being directly applied in HTTP headers against HSTS specification section 7.12:

An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.

SOURCE:
https://tools.ietf.org/html/rfc6797#section-7.2

@konklone
Copy link
Contributor

@bandrzej Thanks! (And sorry for the delay, I somehow missed the notification of this issue.)

I don't have a way of testing this myself, but I'm happy to trust your work here. Thanks for the improvement!

@konklone konklone merged commit c50edf9 into GSA:master Nov 20, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants