const classafSleepSafe::StrictTransportGuard

Guards against protocol downgrade attacks and Cookie hijacking by setting a Strict-Transport-Security HTTP response header that tells browsers to use HTTPS.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

See HTTP Strict Transport Security (HSTS) and RFC 6797 for details.

IoC Configuration

HSTS is disabled by default as you don't want to force your development environment into using HTTPS! To enable, contribute this class to the SleepSafeMiddleware configuration:

@Contribute { serviceType=SleepSafeMiddleware# }
Void contributeSleepSafeMiddleware(Configuration config, IocEnv iocEnv) {
    if (iocEnv.isProd)
        config[StrictTransportGuard#] = StrictTransportGuard(5day)
}