evilpacket/helmet — pull request #52 by EvanHahn (2014-06-11 03:10:51+00:00)
Title: Rewrite HSTS

This rewrites HSTS to have the following API:

```javascript
app.use(helmet.hsts({
maxAge: 12340000, // required parameter, now in milliseconds
includeSubdomains: true
})
```

If it's Express, it'll set the header if `req.secure` is truthy. Otherwise, there are two ways to set the header:

```javascript
app.use(helmet.hsts({ maxAge: 1000, force: true }))
app.use(helmet.hsts({
maxAge: 2000,
setIf: function (req, res) {
// Will set the header if this function returns a truthy value.
return req.url == '/please_set_header';
}
})
```

Thoughts?