GitHub/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-05-26 07:08:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Make HSTS policy configurable if https is enabled (#4462)

Browse Source 
* Make HSTS policy configurable if https is enabled

* refactor(web): gate HSTS at call site so XUI_SKIP_HSTS doesn't drop the Secure cookie flag

isDirectHTTPSConfigured was being reused for both the HSTS middleware and
the session cookie's Secure flag (web.go:185). Embedding the env-var
check inside it meant setting XUI_SKIP_HSTS=true also stripped Secure
from session cookies on a real HTTPS server. Split the concerns: keep
isDirectHTTPSConfigured honest (cert/key only) and combine it with the
env var at the call site for the HSTS middleware only.

---------

Co-authored-by: Konstantin Kayukin <t_kkayukin@admarketplace.com>
Co-authored-by: Sanaei <ho3ein.sanaei@gmail.com>
This commit is contained in:
Константин
2026-05-19 14:28:05 +02:00
committed by GitHub
parent 121b6e0bd0
commit 758e1ad050
2 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
web/web.go
View File

@@ -154,7 +154,8 @@ func (s *Server) initRouter() (*gin.Engine, error) {
engine := gin.Default()
directHTTPS := s.isDirectHTTPSConfigured()
engine.Use(middleware.SecurityHeadersMiddleware(directHTTPS))
sendHSTS := directHTTPS && !config.IsSkipHSTS()
engine.Use(middleware.SecurityHeadersMiddleware(sendHSTS))
webDomain, err := s.settingService.GetWebDomain()
if err != nil {