                                                                                                                                                                                                                                                                
Received-SPF: pass (google.com: domain of markus.lantha...@gmx.net designates 213.165.64.22 as permitted sender) client-ip=213.165.64.22;
From: "Markus Lanthaler" <markus.lantha...@gmx.net>
To: <symfony-devs@googlegroups.com>
Subject: Add support for HSTS
Date: Wed, 3 Oct 2012 10:48:28 +0200
Message-ID: <506bfbdf.05d70e0a.6cb1.21d9SMTPIN_ADDED@gmr-mx.google.com>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
thread-index: Ac2hQ9t+uz5cmhpPTia2MJWYfauCKw==
Content-Language: de

Hi all,

I've just saw that the HTTP Strict Transport Security (HSTS) draft was
approved [1] and will soon be published as an official standard. Since
Symfony already provides a way to force the use of HTTPS [2] I thought it
might be a good idea to complement this with the "Strict-Transport-Security"
HTTP header. The spec [3] is quite long but the implementation would
actually quite easy. There's even sample code for PHP on Wikipedia [4].

I could do the changes and file a pull request myself but I first wanted to
ask whether this is of interest. I'm also not sure yet what would be the
best way to integrate this in Symfony. Directly in the HttpKernel? Creating
a "kernel.response" listener? Somewhere else?


Cheers,
Markus


[1] https://datatracker.ietf.org/doc/draft-ietf-websec-strict-transport-sec/
[2] http://symfony.com/doc/current/cookbook/security/force_https.html
[3] http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-14
[4]
https://secure.wikimedia.org/wikipedia/en/wiki/HTTP_Strict_Transport_Securit
y#Implementation


--
Markus Lanthaler
@markuslanthaler