From 409cb97cde111e137a6705d58b27a9836b894f52 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Oskar=20Sch=C3=B6ldstr=C3=B6m?= Date: Thu, 29 Oct 2026 09:18:44 -0300 Subject: [PATCH] security: drop preload from the template's HSTS header Submitting a domain to the browser preload lists is practically irreversible, so it should be a deliberate per-domain decision rather than something every new site inherits. Matches generoi/gds-security-hardening#7 and the frontend header telma-lehti-new ships. Co-Authored-By: Claude Opus 5.5 --- .../app/Providers/ContentSecurityPolicyServiceProvider.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/web/app/themes/gds/app/Providers/ContentSecurityPolicyServiceProvider.php b/web/app/themes/gds/app/Providers/ContentSecurityPolicyServiceProvider.php index 9cdeabd2..9f5205a6 100644 --- a/web/app/themes/gds/app/Providers/ContentSecurityPolicyServiceProvider.php +++ b/web/app/themes/gds/app/Providers/ContentSecurityPolicyServiceProvider.php @@ -42,7 +42,9 @@ public function sendHeaders(): void ); // Force client-side TLS (Transport Layer Security) redirection. - header('Strict-Transport-Security: max-age=63072000; includeSubDomains; preload'); + // No 'preload': submitting the domain to the browser preload lists + // is practically irreversible and has to be a deliberate decision. + header('Strict-Transport-Security: max-age=63072000; includeSubDomains'); // Disable content sniffing, since it's an attack vector. header('X-Content-Type-Options: nosniff');