pr comments

f0ssel · f0ssel · commit 803313d4f1ef · 2022-03-30T22:31:09.000Z
diff --git a/cli/start.go b/cli/start.go
@@ -129,13 +129,13 @@ func start() *cobra.Command {
 			}
 			logger := slog.Make(sloghuman.Sink(os.Stderr))
 			options := &coderd.Options{
-				AccessURL:            accessURLParsed,
-				Logger:               logger.Named("coderd"),
-				Database:             databasefake.New(),
-				Pubsub:               database.NewPubsubInMemory(),
-				GoogleTokenValidator: validator,
-				HSTS:                 strictTransportSecurity,
-				SecureCookie:         secureCookie,
+				AccessURL:               accessURLParsed,
+				Logger:                  logger.Named("coderd"),
+				Database:                databasefake.New(),
+				Pubsub:                  database.NewPubsubInMemory(),
+				GoogleTokenValidator:    validator,
+				StrictTransportSecurity: strictTransportSecurity,
+				SecureCookie:            secureCookie,
 			}
 
 			if !dev {
diff --git a/coderd/coderd.go b/coderd/coderd.go
@@ -30,8 +30,8 @@ type Options struct {
 	AWSCertificates      awsidentity.Certificates
 	GoogleTokenValidator *idtoken.Validator
 
-	HSTS         bool
-	SecureCookie bool
+	StrictTransportSecurity bool
+	SecureCookie            bool
 }
 
 // New constructs the Coder API into an HTTP handler.
@@ -50,7 +50,7 @@ func New(options *Options) (http.Handler, func()) {
 	r.Route("/api/v2", func(r chi.Router) {
 		r.Use(
 			chitrace.Middleware(),
-			httpmw.HSTS(api.HSTS),
+			httpmw.StrictTransportSecurity(api.StrictTransportSecurity),
 		)
 		r.Get("/", func(w http.ResponseWriter, r *http.Request) {
 			httpapi.Write(w, http.StatusOK, httpapi.Response{
diff --git a/coderd/httpmw/hsts_test.go b/coderd/httpmw/hsts_test.go
@@ -6,9 +6,10 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"github.com/coder/coder/coderd/httpmw"
 	"github.com/go-chi/chi/v5"
 	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/coderd/httpmw"
 )
 
 func TestStrictTransportSecurity(t *testing.T) {
@@ -32,14 +33,14 @@ func TestStrictTransportSecurity(t *testing.T) {
 
 		res := setup(true)
 		defer res.Body.Close()
-		require.Contains(t, res.Header.Get(httpmw.StrictTransportSecurityHeader), fmt.Sprintf("max-age=%d", int64(httpmw.StrictTransportSecurityMaxAge)))
+		require.Contains(t, res.Header.Get(httpmw.StrictTransportSecurityHeader), fmt.Sprintf("max-age=%d", int64(httpmw.StrictTransportSecurityMaxAge.Seconds())))
 	})
 	t.Run("False", func(t *testing.T) {
 		t.Parallel()
 
 		res := setup(false)
 		defer res.Body.Close()
-		require.NotContains(t, res.Header.Get(httpmw.StrictTransportSecurityHeader), fmt.Sprintf("max-age=%d", int64(httpmw.StrictTransportSecurityMaxAge)))
+		require.NotContains(t, res.Header.Get(httpmw.StrictTransportSecurityHeader), fmt.Sprintf("max-age=%d", int64(httpmw.StrictTransportSecurityMaxAge.Seconds())))
 		require.Equal(t, res.Header.Get(httpmw.StrictTransportSecurityHeader), "")
 	})
 }
