Add support for HTTP Strict-Transport-Security header

[cattywampus]

Describe the problem

When a web server is configured to use HTTP Strict-Transport-Security include a Strict-Transport-Security response header tells the browser to force all requests for that domain to be sent over HTTPS for all future requests up until the header policy exceeds the max-age expiration. This provides a improved protection against some web attacks that exploit accessing resources over HTTP.

It was discovered by the security team for my customer that this header is not present in the response sent from the on-premise Chef Supermarket to the browser. I also tested the the public supermarket and the header is not present there either. This was considered to be a LOW security finding, so while the need for this fix isn't critical, it seems like it would be a valuable add to the project.

Software Version

Tested and verified in latest release of Chef Supermarket - 3.3.20

Replication Case

• Activate your browsers development tools
• Select the Network tab
• Go to the on-prem, public, or locally hosted (from source) Chef Supermarket
• Select the supermarket.chef.io document from the list of response documents sent from the web server
• Select the Headers view of that document to see the request and response headers. Scroll down to the response headers
• Look for Strict-Transport-Security to be in this list. It should be missing

Stacktrace

``` N/A ```

Possible Solution

HSTS is enabled in Rails if the web application is configured to use force_ssl. In this case since SSL/TLS is managed at the NGinx web server the HSTS header should be added there to the rails nginx configuration.

[sarwarOps]

Can someone guide me on how to add HSTS header in Chef's nginx?

[bryanmartin-okta]

@robbkidd Do you have an idea of when this will be added to Supermarket? This has been flagged as a security violation that I need to remediate immediately.

[robbkidd]

@bryanmartin-okta (and others interested) with you having bumped the issue, I'm poking at it again.

Have you looked at the PR (even in its labeled "WIP" state)? If so, have you formed an opinion about that as a reasonable fix?

[robbkidd]

The fix in #1855 was merged and included in Supermarket v3.4.1. That build version is currently available in the (aptly-named?) current channel (linked to at downloads.chef.io as "Development Releases").

[robbkidd]

And now 3.4.1 was released to stable. https://discourse.chef.io/t/supermarket-3-4-1-released/17973

[cattywampus]

My project just deployed this tonight and we see the Strict-Transport-Security response header set in our installation of Supermarket. Thanks @robbkidd!