From f64efa79bd78ab59cb65588feacf93e0de475e48 Mon Sep 17 00:00:00 2001 From: Max Kanat-Alexander Date: Mon, 27 Sep 2010 20:16:57 -0700 Subject: Bug 594990: Make the Strict-Transport-Security HTTP header only be sent if a particular parameter is enabled. r=glob, a=mkanat --- template/en/default/admin/params/advanced.html.tmpl | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'template') diff --git a/template/en/default/admin/params/advanced.html.tmpl b/template/en/default/admin/params/advanced.html.tmpl index 4caa2f1dc..2414a46fb 100644 --- a/template/en/default/admin/params/advanced.html.tmpl +++ b/template/en/default/admin/params/advanced.html.tmpl @@ -24,6 +24,19 @@ desc = "Settings for advanced configurations." %] +[% sts_desc = BLOCK %] + Enables the sending of the + Strict-Transport-Security + header along with HTTP responses on SSL connections. This adds greater + security to your SSL connections by forcing the browser to always + access your domain over SSL and never accept an invalid certificate. + However, it should only be used if you have the ssl_redirect + parameter turned on, Bugzilla is the only thing running + on its domain (i.e., your urlbase is something like + http://bugzilla.example.com/), and you never plan to disable + the ssl_redirect parameter. +[% END %] + [% param_descs = { cookiedomain => "If your website is at 'www.foo.com', setting this to" @@ -47,4 +60,6 @@ _ " necessary to enter its URL if the web server cannot access the" _ " HTTP_PROXY environment variable. If you have to authenticate," _ " use the http://user:pass@proxy_url/ syntax.", + + strict_transport_security => sts_desc, } %] -- cgit v1.2.3-24-g4f1b