Merge pull request #3843 from dokku/3709-hsts

Enable HSTS by default

tests/apps/multi/app.py

@@ -1,6 +1,9 @@
 import os
 from flask import Flask, render_template
-from werkzeug.wsgi import SharedDataMiddleware
+try:
+    from werkzeug.wsgi import SharedDataMiddleware
+except ImportError:
+    from werkzeug.middleware.shared_data import SharedDataMiddleware
 
 app = Flask(__name__)
 

tests/unit/40_nginx-vhosts_2.bats

@@ -107,6 +107,89 @@ assert_error_log() {
   assert_failure
 }
 
+@test "(nginx-vhosts) nginx:set hsts" {
+  setup_test_tls wildcard
+  local HSTS_CONF="/home/dokku/${TEST_APP}/nginx.conf.d/hsts.conf"
+
+  run deploy_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Enabling HSTS"
+
+  run /bin/bash -c "test -f $HSTS_CONF"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  run /bin/bash -c "cat $HSTS_CONF | grep includeSubdomains"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  run /bin/bash -c "cat $HSTS_CONF | grep 'max-age=15724800'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  run /bin/bash -c "cat $HSTS_CONF | grep preload"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku nginx:set $TEST_APP hsts-include-subdomains false"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  run /bin/bash -c "dokku nginx:build-config $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  run /bin/bash -c "cat $HSTS_CONF | grep includeSubdomains"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "dokku nginx:set $TEST_APP hsts-max-age 120"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  run /bin/bash -c "dokku nginx:build-config $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  run /bin/bash -c "cat $HSTS_CONF | grep 'max-age=120'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku nginx:set $TEST_APP hsts-preload true"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  run /bin/bash -c "dokku nginx:build-config $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  run /bin/bash -c "cat $HSTS_CONF | grep preload"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku nginx:set $TEST_APP hsts false"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku nginx:build-config $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output_contains "Enabling HSTS" 0
+
+  run /bin/bash -c "test -f $DOKKU_ROOT/$TEST_APP/nginx.conf.d/hsts.conf"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+}
+
 @test "(nginx-vhosts) nginx:set bind-address" {
   run deploy_app
   echo "output: $output"