Function HSTS

coderd/httpmw/hsts.go:63–72

HSTS will add the strict-transport-security header if enabled. This header forces a browser to always use https for the domain after it loads https once. Meaning: On first load of product.coder.com, they are redirected to https. On all subsequent loads, the client's local browser forces https. This

(next http.Handler, cfg HSTSConfig)

// Full header example:
// Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
func HSTS(next http.Handler, cfg HSTSConfig) http.Handler {
	if cfg.HeaderValue == "" {
		// No header, so no need to wrap the handler.
		return next
	}
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set(hstsHeader, cfg.HeaderValue)
		next.ServeHTTP(w, r)
	})
}