{"action":"created","issue":{"url":"https://api.github.com/repos/owncloud/core/issues/15342","labels_url":"https://api.github.com/repos/owncloud/core/issues/15342/labels{/name}","comments_url":"https://api.github.com/repos/owncloud/core/issues/15342/comments","events_url":"https://api.github.com/repos/owncloud/core/issues/15342/events","html_url":"https://github.com/owncloud/core/issues/15342","id":65507847,"number":15342,"title":"Webserver security settings do net get recognized","user":{"login":"mmattel","id":3321281,"avatar_url":"https://avatars.githubusercontent.com/u/3321281?v=3","gravatar_id":"","url":"https://api.github.com/users/mmattel","html_url":"https://github.com/mmattel","followers_url":"https://api.github.com/users/mmattel/followers","following_url":"https://api.github.com/users/mmattel/following{/other_user}","gists_url":"https://api.github.com/users/mmattel/gists{/gist_id}","starred_url":"https://api.github.com/users/mmattel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mmattel/subscriptions","organizations_url":"https://api.github.com/users/mmattel/orgs","repos_url":"https://api.github.com/users/mmattel/repos","events_url":"https://api.github.com/users/mmattel/events{/privacy}","received_events_url":"https://api.github.com/users/mmattel/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/owncloud/core/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/owncloud/core/labels/triage","name":"triage","color":"00FFFF"}],"state":"open","locked":false,"assignee":{"login":"LukasReschke","id":878997,"avatar_url":"https://avatars.githubusercontent.com/u/878997?v=3","gravatar_id":"","url":"https://api.github.com/users/LukasReschke","html_url":"https://github.com/LukasReschke","followers_url":"https://api.github.com/users/LukasReschke/followers","following_url":"https://api.github.com/users/LukasReschke/following{/other_user}","gists_url":"https://api.github.com/users/LukasReschke/gists{/gist_id}","starred_url":"https://api.github.com/users/LukasReschke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LukasReschke/subscriptions","organizations_url":"https://api.github.com/users/LukasReschke/orgs","repos_url":"https://api.github.com/users/LukasReschke/repos","events_url":"https://api.github.com/users/LukasReschke/events{/privacy}","received_events_url":"https://api.github.com/users/LukasReschke/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/owncloud/core/milestones/37","html_url":"https://github.com/owncloud/core/milestones/8.2-next","labels_url":"https://api.github.com/repos/owncloud/core/milestones/37/labels","id":993629,"number":37,"title":"8.2-next","description":"","creator":{"login":"craigpg","id":160667,"avatar_url":"https://avatars.githubusercontent.com/u/160667?v=3","gravatar_id":"","url":"https://api.github.com/users/craigpg","html_url":"https://github.com/craigpg","followers_url":"https://api.github.com/users/craigpg/followers","following_url":"https://api.github.com/users/craigpg/following{/other_user}","gists_url":"https://api.github.com/users/craigpg/gists{/gist_id}","starred_url":"https://api.github.com/users/craigpg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/craigpg/subscriptions","organizations_url":"https://api.github.com/users/craigpg/orgs","repos_url":"https://api.github.com/users/craigpg/repos","events_url":"https://api.github.com/users/craigpg/events{/privacy}","received_events_url":"https://api.github.com/users/craigpg/received_events","type":"User","site_admin":false},"open_issues":475,"closed_issues":1,"state":"open","created_at":"2015-02-24T16:19:37Z","updated_at":"2015-05-21T15:44:50Z","due_on":null,"closed_at":null},"comments":10,"created_at":"2015-03-31T17:47:18Z","updated_at":"2015-05-21T22:53:50Z","closed_at":null,"body":"Ubuntu 14.04, nginx 1.7.11, MySQL, Browser W7/Opera 28\r\n\r\n@LukasReschke \r\n\r\nInstalling via \"sudo ocdev base --dir /xxxx\" a new instance of oC from master for testing and finalizing the installation.\r\n\r\nI have configured in my sites server ssl block:\r\n        add_header Strict-Transport-Security \"max-age=63072000; includeSubDomains; always; preload\";\r\n        add_header X-Content-Type-Options nosniff;\r\n        add_header X-Frame-Options \"SAMEORIGIN\";\r\n \r\nBut after installing, I get warnings at the admin page about missing of these settings\r\n\r\n![image](https://cloud.githubusercontent.com/assets/3321281/6925267/9b344be8-d7de-11e4-9602-b9853a9ce4f6.png)\r\n\r\nThis belongs to: core/js/tests/specs/setupchecksSpec.js\r\n\r\nIf I do:  sudo curl -I https://myserver -k\r\n\r\nHTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 31 Mar 2015 17:22:43 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nConnection: keep-alive\r\nX-Powered-By: PHP/5.5.9-1ubuntu4.7\r\nSet-Cookie: xxxx; path=/; HttpOnly\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nContent-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-src *; img-src *; font-src 'self' data:; media-src *; connect-src *\r\nX-XSS-Protection: 1; mode=block\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: Sameorigin\r\nX-Robots-Tag: none\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains; always; preload\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\n\r\n(interestingly I get nosniff and sameorigin twice but I never configured this twice, was looking for it with grep but anyway...)"},"comment":{"url":"https://api.github.com/repos/owncloud/core/issues/comments/104444057","html_url":"https://github.com/owncloud/core/issues/15342#issuecomment-104444057","issue_url":"https://api.github.com/repos/owncloud/core/issues/15342","id":104444057,"user":{"login":"RandolfCarter","id":2631274,"avatar_url":"https://avatars.githubusercontent.com/u/2631274?v=3","gravatar_id":"","url":"https://api.github.com/users/RandolfCarter","html_url":"https://github.com/RandolfCarter","followers_url":"https://api.github.com/users/RandolfCarter/followers","following_url":"https://api.github.com/users/RandolfCarter/following{/other_user}","gists_url":"https://api.github.com/users/RandolfCarter/gists{/gist_id}","starred_url":"https://api.github.com/users/RandolfCarter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RandolfCarter/subscriptions","organizations_url":"https://api.github.com/users/RandolfCarter/orgs","repos_url":"https://api.github.com/users/RandolfCarter/repos","events_url":"https://api.github.com/users/RandolfCarter/events{/privacy}","received_events_url":"https://api.github.com/users/RandolfCarter/received_events","type":"User","site_admin":false},"created_at":"2015-05-21T22:53:50Z","updated_at":"2015-05-21T22:53:50Z","body":"Just encountered the \"Strict-Transport-Security\" check (because it is included in oc 8.1b2). From my experiments it seems that the check is expecting a wrong format: It expects the Header to look like this (with such a header in the apache config, the warning is not shown anymore):\r\n```\r\nHeader always set Strict-Transport-Security \"31536000; includeSubDomains\"\r\n```\r\nwhen in fact it should look like this:\r\n```\r\nHeader always set Strict-Transport-Security \"max-age=31536000; includeSubDomains\"\r\n```\r\n(notice the added max-age).\r\nA quick fix could be:\r\n```\r\n--- core/js/setupcheck.js.old      2015-05-22 00:51:22.784632554 +0200\r\n+++ core/js/setupchecks.js.new      2015-05-22 00:49:23.728170921 +0200\r\n@@ -153,6 +153,7 @@\r\n                                                } else {\r\n                                                        transportSecurityValidity = transportSecurityValidity.substring(8);\r\n                                                }\r\n+                                        transportSecurityValidity = transportSecurityValidity.split('=').pop();\r\n                                        }\r\n\r\n                                        if(isNaN(transportSecurityValidity) || transportSecurityValidity <= 2678399) {\r\n```\r\nBut I would leave the final implementation of that to more capable hands, my JS is a bit rusty ;)"}}