Set HSTS max-age to 15768000

[jbickar]

READY FOR REVIEW

Summary

• Per discussion in Slack, improve SSL Labs score from A to A+

Review By (Date)

• Meh, whenever

Criticality

• How critical is this PR on a 1-10 scale? 1/10

Review Tasks

Setup tasks and/or behavior to test

1. Deploy this branch to a dev/test environment
2. Run https://www.ssllabs.com/ssltest/ on the hostname and see what score you get

[sherakama]

@jbickar What are your thoughts on bumping this up to 1 year and submitting to https://hstspreload.org/?

[jbickar]

I don't have a problem with it philosophically. I don't know the application well enough to know if that's a risk; my hunch says it's not. https://hstspreload.org/ suggests ramping up the max-age in stages and ultimately increasing to max-age=63072000; includeSubDomains; preload

[jbickar]

I would say since you're already using HSTS and you haven't had any user complaints, it doesn't seem risky.

[jbickar]

It looks like we've been using it on all sites since 2020, so preloading and a long max-age seems good by me.

[sherakama]

31 meelyon

[sherakama]

Moving forward with 1 year. Thanks @jbickar

[jbickar]

That is some ... A+ work.