{"action":"closed","issue":{"url":"https://api.github.com/repos/swanson/stringer/issues/382","labels_url":"https://api.github.com/repos/swanson/stringer/issues/382/labels{/name}","comments_url":"https://api.github.com/repos/swanson/stringer/issues/382/comments","events_url":"https://api.github.com/repos/swanson/stringer/issues/382/events","html_url":"https://github.com/swanson/stringer/issues/382","id":100622734,"number":382,"title":"prevent SSL-stripping MITM using HTTP Strict Transport Security","user":{"login":"InPermutation","id":1096993,"avatar_url":"https://avatars.githubusercontent.com/u/1096993?v=3","gravatar_id":"","url":"https://api.github.com/users/InPermutation","html_url":"https://github.com/InPermutation","followers_url":"https://api.github.com/users/InPermutation/followers","following_url":"https://api.github.com/users/InPermutation/following{/other_user}","gists_url":"https://api.github.com/users/InPermutation/gists{/gist_id}","starred_url":"https://api.github.com/users/InPermutation/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/InPermutation/subscriptions","organizations_url":"https://api.github.com/users/InPermutation/orgs","repos_url":"https://api.github.com/users/InPermutation/repos","events_url":"https://api.github.com/users/InPermutation/events{/privacy}","received_events_url":"https://api.github.com/users/InPermutation/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-08-12T19:59:30Z","updated_at":"2015-10-08T02:11:31Z","closed_at":"2015-10-08T02:11:31Z","body":"When terminating requests with SSL, you should enable [HTTP Strict Transport Security](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security).\r\n\r\nHeroku serves a wildcard *.herokuapp.com certificate, so for most people, HSTS should be enabled.\r\n\r\nIf you're developing on localhost, hosting Stringer on a VPS but you don't want to pay for a certificate, or using a CNAME without installing the Heroku SSL addon, you won't have SSL. In those cases, HSTS should not be enabled."}}