Merge pull request #37 from Progmasoft/fix/hsts-preload

Treat progmasoft.com as an HSTS-preloaded domain

1 files changed, 8 insertions, 0 deletions

diff --git a/apps/api/Program.cs b/apps/api/Program.cs
index fd6e97b..3eb96c9 100644
--- a/apps/api/Program.cs
+++ b/apps/api/Program.cs
@@ -47,6 +47,14 @@ if (!string.IsNullOrWhiteSpace(googleClientId) && !string.IsNullOrWhiteSpace(goo
     });
 }
 builder.Services.AddProblemDetails();
+// progmasoft.com is served as if .com required HSTS: the API answers with the same preload header as Nginx, so a
+// proxied response never carries two different policies.
+builder.Services.AddHsts(options =>
+{
+    options.MaxAge = TimeSpan.FromDays(730);
+    options.IncludeSubDomains = true;
+    options.Preload = true;
+});
 builder.Services.AddHealthChecks();
 builder.Services.AddRateLimiter(options =>
 {