mod_audit_auth: Ignore FAST authentication events by default
FAST is more like a cookie that allows linking new connections to a previous
(e.g. password) authentication. Since we assume that FAST tokens are secure
(not user generated) and not shareable, it reduces a lot of noise by filtering
out uninteresting authentication events.
-- HTTP Strict Transport Security
-- https://www.rfc-editor.org/info/rfc6797
module:set_global();
local http_server = require "net.http.server";
local hsts_header = module:get_option_string("hsts_header", "max-age=31556952"); -- This means "Don't even try to access without HTTPS for a year"
local redirect = module:get_option_boolean("hsts_redirect", true);
module:wrap_object_event(http_server._events, false, function(handlers, event_name, event_data)
local request, response = event_data.request, event_data.response;
if request and response then
if request.secure then
response.headers.strict_transport_security = hsts_header;
elseif redirect then
-- This won't get the port number right
response.headers.location = "https://" .. request.host .. request.path .. (request.query and "?" .. request.query or "");
return 301;
end
end
return handlers(event_name, event_data);
end);