Adding HSTS middleware

middleware/hsts.js

@@ -0,0 +1,12 @@
+//
+// Copyright (c) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+//
+
+var hsts = require('hsts');
+
+module.exports = hsts({
+  maxAge: 10886400000,     // Must be at least 18 weeks to be approved
+  includeSubDomains: true, // Must be enabled to be approved
+  preload: true,
+});

middleware/index.js

@@ -10,6 +10,7 @@ var bodyParser = require('body-parser');
 var compression = require('compression');
 
 module.exports = function initMiddleware(app, express, config, dirname, redisClient) {
+    app.use(require('./hsts'));
     require('./appInsights')(config);
 
     app.set('views', path.join(dirname, 'views'));

package.json

@@ -2,7 +2,7 @@
   "name": "open-source-portal-for-github",
   "author": "Microsoft Corporation",
   "contributors": [
-      "Wilcox, Jeff <jwilcox@microsoft.com>"
+    "Wilcox, Jeff <jwilcox@microsoft.com>"
   ],
   "version": "4.0.0-alpha.0",
   "license": "MIT",
@@ -13,10 +13,10 @@
     "organization"
   ],
   "tags": [
-      "github",
-      "node",
-      "management",
-      "organization"
+    "github",
+    "node",
+    "management",
+    "organization"
   ],
   "scripts": {
     "start": "node ./bin/www",
@@ -36,6 +36,7 @@
     "debug": "~2.2.0",
     "express": "~4.13.3",
     "express-session": "^1.11.3",
+    "hsts": "^1.0.0",
     "jade": "1.11.0",
     "moment": "^2.10.6",
     "morgan": "~1.6.1",