From f690c065246f1a31e732c0a24100401e58a1adb2 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Mon, 5 Dec 2011 18:34:28 -0200
Subject: HSTS support

---
 templates/site.erb | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'templates')

diff --git a/templates/site.erb b/templates/site.erb
index 25dd22d..246e616 100644
--- a/templates/site.erb
+++ b/templates/site.erb
@@ -4,8 +4,12 @@
 <% if server_alias != false %>   ServerAlias <%= server_alias %><% end %>
    DocumentRoot <%= docroot %>
  <% if https_redirect != false %>
+    # Use HTTP Strict Transport Security to force client to use secure connections only
+    Header always set Strict-Transport-Security "max-age=15768000; includeSubDomains"
+
+    # Redirect all HTTP to HTTPS
     RewriteEngine On
-    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
+    RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [redirect=301]
 <% if redirect_match != false %>   RedirectMatch ^/$ <%= protocol %>://<%= title %>.<%= hosting_domain %>/<%= redirect_match %><% end %>
 <% if redirect != false %>   Redirect <%= redirect %><% end %>
 <% if aliases != false %><% aliases.each do |map| -%>
-- 
cgit v1.2.3