Installation

Strict-Transport-Security in mojolicious

Strict-Transport-Security in mojolicious

by Andras Balogh -
Number of replies: 3
We just upgraded our server from 2.17 (Apache2) to 2.19 (mojolicious). I appreciate all the help I received here with it.

We passed the IT security scan, but my IT contact mentioned that the new 2.19 installation has been rated "only A" by ssllabs instead of the "A+" rating of the previous 2.17.
I was informed that HSTS (Strict-Transport-Security) configuration would increase security rating.

I installed Mojolicious::Plugin::SecurityHeader but I don't know how one could use it for WeBWorK.
 

In reply to Andras Balogh

Re: Strict-Transport-Security in mojolicious

by Glenn Rice -

Add the lines

plugins:
  - SecurityHeader:
    - Strict-Transport-Security: -1

to your conf/webwork2.mojolicious.yml file.

Although, I can give no guarantee that the plugin will work.

In reply to Glenn Rice

Re: Strict-Transport-Security in mojolicious

by Glenn Rice -
I couldn't get the plugin to work. However, there is a mechanism already built in to add extra headers to requests. If you set

extra_headers:
  '.*':
    Strict-Transport-Security: 'max-age=31536000'
that will add the Strict-Transport-Security header to all routes served by the webwork2 app.

I tested this approach, and was able to get this to work.