aptible/docker-nginx — pull request #21 by aaw (2014-10-20 19:01:05+00:00)
Title: Adding HSTS header when FORCE_SSL is selected

The FORCE_SSL variable currently redirects any url from HTTP to HTTPS. This
patch adds the Strict-Transport-Security header in the response from HTTPS
requests, which makes any modern browser (except IE) remember that it should
always connect via HTTPS to any url on the same domain. This prevents SSL
stripping, where users are directed to click on an HTTP url and MITM'ed before
the server has a chance to upgrade to HTTPS.

The HSTS_MAX_AGE parameter can be used to configure the number of
seconds a browser remembers to always connect with HTTPS. The default is
one year.

I haven't included the "includeSubDomains" option for this header, since
that's probably too aggressive for a generic config like this. It can be
exposed as via a flag later if needed.