#26947: Support appending the 'preload' directive to the HSTS header
-------------------------------+--------------------------
Reporter: edmorley | Owner: edmorley
Type: New feature | Status: new
Component: HTTP handling | Version: master
Severity: Normal | Keywords: hsts preload
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+--------------------------
Django currently supports enabling the `Strict-Transport-Security` header,
including specifying whether the `includeSubDomains` directive should be
included within it:
https://docs.djangoproject.com/en/1.9/ref/settings/#std:setting-
SECURE_HSTS_SECONDS
https://docs.djangoproject.com/en/1.9/ref/settings/#secure-hsts-include-
subdomains
However there is currently no way to append the `preload` directive to
that header, which is required to indicate that the site owner consents to
the HSTS header being added to browser's pre-loaded list of sites that
should only be accessed over HTTPS:
https://hstspreload.appspot.com/
https://developer.mozilla.org/en-
US/docs/Web/Security/HTTP_strict_transport_security#Preloading_Strict_Transport_Security
https://www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet#Examples
I propose the addition of a new preference named `SECURE_HSTS_PRELOAD`
that enables the directive, and behaves in a similar manner to defining
`SECURE_HSTS_INCLUDE_SUBDOMAINS`.
I'll open a PR shortly :-)
--
Ticket URL: <https://code.djangoproject.com/ticket/26947>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/051.90ce21a4cfbba35954e020115681105a%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
