From 897f5189b04a468449a007c6a8209af2ee63811f Mon Sep 17 00:00:00 2001
From: Marcel Klehr <mklehr@gmx.net>
Date: Tue, 17 Jun 2014 13:21:38 +0200
Subject: [PATCH] Enable HSTS for TLS connections

Don't use X-Frame-Options: deny for now
---
 src/node/hooks/express.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/node/hooks/express.js b/src/node/hooks/express.js
index 7e9546c2..61d9ae89 100644
--- a/src/node/hooks/express.js
+++ b/src/node/hooks/express.js
@@ -71,9 +71,9 @@ exports.restartServer = function () {
   }
 
   app.use(function (req, res, next) {
-    res.header("X-Frame-Options", "deny");
+    // res.header("X-Frame-Options", "deny"); // breaks embedded pads
     if(settings.ssl){ // if we use SSL
-      res.header("X-Frame-Options", "max-age=31536000; includeSubDomains");
+      res.header("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
     }
 
     res.header("Server", serverName);