Changeset 81bb9c5 in Klonkt

Timestamp:

06/28/2026 03:44:15 PM (2 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

897c33b

Parents:

f7d142f

git-author:

Robin Genis <roboburr@…> (06/28/2026 03:42:45 PM)

git-committer:

Robin Genis <roboburr@…> (06/28/2026 03:44:15 PM)

Message:

chore(hsts): make includeSubDomains+preload opt-in via HSTS_STRICT

Default ships a plain long max-age (safe on any domain a self-hoster runs). The
aggressive includeSubDomains+preload (which affect the operator's other subdomains and
can bake their domain into browsers) are opt-in via HSTS_STRICT=1, set on domains we own.

• server.js — build hsts options from HSTS_STRICT
• .env.example — document HSTS_STRICT

Files:

• .env.example (modified) (1 diff)
• src/server.js (modified) (2 diffs)

.env.example

@@ -20 +20 @@
 # set it for production so email/login links point at the right place.
 PUBLIC_BASE_URL=
+
+# Strict HSTS. By default Klonkt sends a plain long max-age (safe on any domain).
+# Set HSTS_STRICT=1 ONLY if Klonkt owns the whole domain incl. all its subdomains:
+# it adds `includeSubDomains; preload`, which forces every subdomain to HTTPS and can
+# get your domain baked into browsers near-permanently. Leave unset if unsure.
+# HSTS_STRICT=1
 
 # ── Administrator ───────────────────────────────────────────────────

src/server.js

@@ -96 +96 @@
 app.use((req, res, next) => { res.locals.cspNonce = crypto.randomBytes(16).toString('base64'); next(); });
 
+// HSTS. The default ships a plain long max-age — safe on ANY domain. includeSubDomains +
+// preload are aggressive (they affect the operator's OTHER subdomains and can get their
+// domain baked into browsers near-permanently), so they're opt-in via HSTS_STRICT=1 — set
+// only on domains you fully own (e.g. the klonkt.com fleet). Self-hosters get the safe default.
+// NB: Helmet defaults includeSubDomains to true, so the safe default must disable it explicitly.
+const hstsOptions = { maxAge: 31536000, includeSubDomains: false, preload: false };
+if (process.env.HSTS_STRICT === '1') { hstsOptions.includeSubDomains = true; hstsOptions.preload = true; }
+
 app.use(helmet({
   contentSecurityPolicy: {
@@ -139 +147 @@
     },
   },
-  hsts: { maxAge: 31536000, includeSubDomains: true, preload: true },
+  hsts: hstsOptions,
   frameguard: { action: 'sameorigin' },
   referrerPolicy: { policy: 'strict-origin-when-cross-origin' },