Add HTTPS redirect and HSTS headers.

Add HTTPS redirect and HSTS headers.

Re: https://code.google.com/p/chromium/issues/detail?id=158522

[cmp, 2012-11-16 18:20:52]

+palmer to cc

https://codereview.appspot.com/6844058/diff/1/codereview/middleware.py
File codereview/middleware.py (right):

https://codereview.appspot.com/6844058/diff/1/codereview/middleware.py#newcode98
codereview/middleware.py:98: "max-age=%d" % settings.HSTS_MAX_AGE)
double quotes to single quotes here

https://codereview.appspot.com/6844058/diff/1/codereview/middleware.py#newcod...
codereview/middleware.py:101: 
remove lines 100-101

https://codereview.appspot.com/6844058/diff/1/settings.py
File settings.py (right):

https://codereview.appspot.com/6844058/diff/1/settings.py#newcode36
settings.py:36: HSTS_MAX_AGE = 31536000 # 1 year in seconds
please change the large int to 60*60*24*365

insert an extra space before "#", append a period to comment

[M-A, 2012-11-16 18:33:06]

+guido, FYI.

lgtm with cmp's nits.

https://codereview.appspot.com/6844058/diff/1/settings.py
File settings.py (right):

https://codereview.appspot.com/6844058/diff/1/settings.py#newcode40
settings.py:40: 'codereview.middleware.AddHSTSHeaderMiddleware',
I wonder about the ordering here but it's been too long since I last read about
these to figure out if it's the best place.

[iannucci, 2012-11-16 19:05:08]

On 2012/11/16 18:33:06, M-A wrote:
> +guido, FYI.
> 
> lgtm with cmp's nits.
> 
> https://codereview.appspot.com/6844058/diff/1/settings.py
> File settings.py (right):
> 
> https://codereview.appspot.com/6844058/diff/1/settings.py#newcode40
> settings.py:40: 'codereview.middleware.AddHSTSHeaderMiddleware',
> I wonder about the ordering here but it's been too long since I last read
about
> these to figure out if it's the best place.

The middleware goes top to bottom for requests. I put it there so that it will
redirect to https before passing through the rest of the rietveld middleware.
For response it shouldn't really matter.

[iannucci, 2012-11-16 19:11:15]

On 2012/11/16 19:05:08, iannucci wrote:
> On 2012/11/16 18:33:06, M-A wrote:
> > +guido, FYI.
> > 
> > lgtm with cmp's nits.
> > 
> > https://codereview.appspot.com/6844058/diff/1/settings.py
> > File settings.py (right):
> > 
> > https://codereview.appspot.com/6844058/diff/1/settings.py#newcode40
> > settings.py:40: 'codereview.middleware.AddHSTSHeaderMiddleware',
> > I wonder about the ordering here but it's been too long since I last read
> about
> > these to figure out if it's the best place.
> 
> The middleware goes top to bottom for requests. I put it there so that it will
> redirect to https before passing through the rest of the rietveld middleware.
> For response it shouldn't really matter.

Though, the code in middleware should match the ordering in settings, so I did
that.

[palmer1, 2012-11-16 19:14:13]

Thanks! LGTM.

[iannucci, 2012-11-20 01:43:59]

m-a need another look :)

Ok, I cleaned up a few things (check patchlog), and tested (on
testfoo-codereview.appspot.com). There is currently an appengine bug
http://code.google.com/p/googleappengine/issues/detail?id=7427 which is
stripping/blocking the HSTS header.

However, I'd like to land this anyhow, since the redirect works, and once the
appengine bug is fixed, the header will come through. The worst that could
happen is that I mis-spelled the header (I didn't) and it has no effect.

If this looks good, please land it :). Thanks!
R

[M-A, 2012-11-20 14:41:06]

committed