AEROGEAR-976 - HSTS filter

## HSTS support

**HSTS** (HTTP Strict Transport Security) is a security policy mechanism which enforce users to interact with SSL connections only, preventing attacks like man-in-the-middle.

This implementation is based on [RFC 6797](http://tools.ietf.org/html/rfc6797) and depends on web browser implementation. Currently this implementation is supported only in Firefox and Chrome, for further details, please check [caniuse.com](http://caniuse.com/#search=hsts) or the RFC. 

## Common questions?

* How it will work on non supported browsers?

	- User will be redirected to HTTPS *location* attribute, but the browser won't be remembered to force HTTPS. 
	
* Is it required on AeroGear Controller and Security?

	- No, it's an optional feature
	
* With HSTS my system is bullet proof? 

	- Only if you're disconnect and your server is hosted in an island. Security is hard.


## Getting started

### 1. Configuration

#### Parameters on [web.xml]():

Basically, browsers that support this feature, are able to remember the fact that a particular website requires HTTPS only, the next visit the respective site the agent will remember about this option on HTTPS only. 

* **max-age**: set how long the agent (browser) will be remembered to force HTTPS. 
* **include-subdomain**: this rule will be applied to all the subdomains or not. (*accepted values*: true/false).
* **location:** when user try to access *http://aerogear.org* for example, the default behaviour is to response with *HTTP 301* (indicating a permanent redirect)  pointing the browser to a new location.


#### JBoss configuration file:

To get started, please install and configure SSL support on JBoss [http://docs.jboss.org/jbossweb/3.0.x/ssl-howto.html](http://docs.jboss.org/jbossweb/3.0.x/ssl-howto.html).

You can do it with:

	$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA

During the process make sure to setup the default password (*"changeit"*) already on JBoss, for testing purposes.

Copy this file [standalone.xml](https://gist.github.com/abstractj/a91c4fc960975a111803) to *$JBOSS_HOME/standalone/configuration/*.

### 2. Deploying

- Install AG Security

		git clone git@github.com:abstractj/aerogear-security.git
		cd aerogear-security && git checkout AEROGEAR-976 
		mvn clean install

- Install AG Security PicketLink
	
		git clone git@github.com:abstractj/aerogear-security-picketlink.git
		cd aerogear-security-picketlink && git checkout AEROGEAR-976
		mvn clean install
		
- Deploy AG Controller demo

		git@github.com:abstractj/aerogear-controller-demo.git
		cd aerogear-controller-demo && git checkout AEROGEAR-976 
		mvn clean package
		cp target/aerogear-controller-demo.war $JBOSS_HOME/standalone/deployments
		
### 3. Testing

- Visit [http://localhost:8080/aerogear-controller-demo](http://localhost:8080/aerogear-controller-demo) and the servlet filter will redirect you to *location* specified into the [web.xml](https://github.com/abstractj/aerogear-controller-demo/blob/AEROGEAR-976/src/main/webapp/WEB-INF/web.xml)

- Inspect HTTP headers on Chrome or Firefox.