<ocdtrekkie>
For those tracking, I got my web app that has HSTS working again... I still haven't figured out how to disable HSTS on it though.
<isd>
congrats.
<isd>
I am coming around to just not doing it with Sandstorm. In any case, tying the HSTS expiration to the cert expiration looks like it would be enough work that I probably won't actually find time to implement it anytime soon.
<ocdtrekkie>
I think it makes sense to support it for people who want it and know what it entails. I just don't think we should implement it by default because it is hard to undo.
<isd>
Maybe we could just add an HSTS=true option to sandstorm.conf and leaf it at that
<isd>
That would also let us easily just set a very long expiration time, without fussing about breaking things for users who weren't expecting it.
<isd>
So not having it on by default lets us be stricter with it, which is nice.
<ocdtrekkie>
Maybe, if that's an easyish solution. Could it be HSTS=lifetime instead of a boolean? I imagine that being something the savvy HSTS user would have opinions on.