{"action":"created","issue":{"url":"https://api.github.com/repos/hackmdio/hackmd/issues/585","repository_url":"https://api.github.com/repos/hackmdio/hackmd","labels_url":"https://api.github.com/repos/hackmdio/hackmd/issues/585/labels{/name}","comments_url":"https://api.github.com/repos/hackmdio/hackmd/issues/585/comments","events_url":"https://api.github.com/repos/hackmdio/hackmd/issues/585/events","html_url":"https://github.com/hackmdio/hackmd/pull/585","id":265125031,"number":585,"title":"Make HSTS Behaviour Configurable (Fixes #584)","user":{"login":"xxyy","id":547070,"avatar_url":"https://avatars2.githubusercontent.com/u/547070?v=4","gravatar_id":"","url":"https://api.github.com/users/xxyy","html_url":"https://github.com/xxyy","followers_url":"https://api.github.com/users/xxyy/followers","following_url":"https://api.github.com/users/xxyy/following{/other_user}","gists_url":"https://api.github.com/users/xxyy/gists{/gist_id}","starred_url":"https://api.github.com/users/xxyy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xxyy/subscriptions","organizations_url":"https://api.github.com/users/xxyy/orgs","repos_url":"https://api.github.com/users/xxyy/repos","events_url":"https://api.github.com/users/xxyy/events{/privacy}","received_events_url":"https://api.github.com/users/xxyy/received_events","type":"User","site_admin":false},"labels":[{"id":264347483,"url":"https://api.github.com/repos/hackmdio/hackmd/labels/feature","name":"feature","color":"0052cc","default":false},{"id":712497432,"url":"https://api.github.com/repos/hackmdio/hackmd/labels/Hacktoberfest","name":"Hacktoberfest","color":"cb4e4c","default":false},{"id":712773388,"url":"https://api.github.com/repos/hackmdio/hackmd/labels/untested","name":"untested","color":"b60205","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/hackmdio/hackmd/milestones/13","html_url":"https://github.com/hackmdio/hackmd/milestone/13","labels_url":"https://api.github.com/repos/hackmdio/hackmd/milestones/13/labels","id":2827366,"number":13,"title":"Next release","description":"Everything in this milestone should be merged or closed for the next release","creator":{"login":"SISheogorath","id":8719867,"avatar_url":"https://avatars1.githubusercontent.com/u/8719867?v=4","gravatar_id":"","url":"https://api.github.com/users/SISheogorath","html_url":"https://github.com/SISheogorath","followers_url":"https://api.github.com/users/SISheogorath/followers","following_url":"https://api.github.com/users/SISheogorath/following{/other_user}","gists_url":"https://api.github.com/users/SISheogorath/gists{/gist_id}","starred_url":"https://api.github.com/users/SISheogorath/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SISheogorath/subscriptions","organizations_url":"https://api.github.com/users/SISheogorath/orgs","repos_url":"https://api.github.com/users/SISheogorath/repos","events_url":"https://api.github.com/users/SISheogorath/events{/privacy}","received_events_url":"https://api.github.com/users/SISheogorath/received_events","type":"User","site_admin":false},"open_issues":16,"closed_issues":19,"state":"open","created_at":"2017-10-10T11:57:37Z","updated_at":"2017-10-12T23:58:59Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2017-10-12T23:42:42Z","updated_at":"2017-10-13T00:03:04Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/hackmdio/hackmd/pulls/585","html_url":"https://github.com/hackmdio/hackmd/pull/585","diff_url":"https://github.com/hackmdio/hackmd/pull/585.diff","patch_url":"https://github.com/hackmdio/hackmd/pull/585.patch"},"body":"This PR allows users to influence HSTS behaviour as outlined in #584. To achieve that, it adds some new configuration settings to `config.json.example` (and `lib/config/default.js`) under the `hsts` key:\r\n````json\r\n\"hsts\": {\r\n  \"enable\": \"true\",\r\n  \"maxAgeSeconds\": \"31536000\",\r\n  \"includeSubdomains\": \"true\",\r\n  \"preload\": \"true\"\r\n}\r\n````\r\nThese defaults should match the currently hard-coded values exactly. The maximum age is provided in seconds to improve readability while still maintaining reasonable configurability. The new options are also represented in `README.md` and `app.json`. For `README.md`, I followed the pattern of existing documentation and provided all the settings as one row, with a JSON example.\r\n\r\nFurther, this PR adds environment variables for configuring aforementioned options: `HMD_HSTS_ENABLE`, `HMD_HSTS_MAX_AGE`, `HMD_HSTS_INCLUDE_SUBDOMAINS`, and `HMD_HSTS_PRELOAD`. I wasn't quite sure on what the policy is for which settings get environment variables, so I split these changes into separate commits so that they can be easily reverted if need be.\r\n\r\nIt also logs a notice if HSTS is disabled while `usessl` is enabled.\r\n\r\nFull disclosure, I have only tested that the app still starts and loads the configuration. I was unable to try actual HSTS behaviour and the log notice because I do not have SSL set up for this app on my local development machine. I can set it up if necessary though."},"comment":{"url":"https://api.github.com/repos/hackmdio/hackmd/issues/comments/336313817","html_url":"https://github.com/hackmdio/hackmd/pull/585#issuecomment-336313817","issue_url":"https://api.github.com/repos/hackmdio/hackmd/issues/585","id":336313817,"user":{"login":"SISheogorath","id":8719867,"avatar_url":"https://avatars1.githubusercontent.com/u/8719867?v=4","gravatar_id":"","url":"https://api.github.com/users/SISheogorath","html_url":"https://github.com/SISheogorath","followers_url":"https://api.github.com/users/SISheogorath/followers","following_url":"https://api.github.com/users/SISheogorath/following{/other_user}","gists_url":"https://api.github.com/users/SISheogorath/gists{/gist_id}","starred_url":"https://api.github.com/users/SISheogorath/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SISheogorath/subscriptions","organizations_url":"https://api.github.com/users/SISheogorath/orgs","repos_url":"https://api.github.com/users/SISheogorath/repos","events_url":"https://api.github.com/users/SISheogorath/events{/privacy}","received_events_url":"https://api.github.com/users/SISheogorath/received_events","type":"User","site_admin":false},"created_at":"2017-10-13T00:03:04Z","updated_at":"2017-10-13T00:03:04Z","author_association":"MEMBER","body":"Since you are a first-time contributor and we are going to change our license soon from MIT to AGPL-3.0 could you please sign/accept: https://github.com/hackmdio/hackmd/pull/578? Otherwise, it causes trouble with relicensing and we want to avoid this. "}}
{"actor":{"display_login":"SISheogorath"}}