Invalidate existing HSTS headers

13 years ago · be194c5b5b
parent f4c9d4c067
commit be194c5b5b
1 changed files with 5 additions and 0 deletions
--- a/lib/base.php
+++ b/lib/base.php
@ -231,6 +231,11 @@ class OC {
 				header("Location: $url");
 				exit();
 			}
+		} else {
+			// Invalidate HSTS headers
+			if (OC_Request::serverProtocol() === 'https') {
+				header('Strict-Transport-Security: max-age=0');
+			}
 		}
 	}