Add HSTS to F# ApiServer and BwdServer

fsharp-backend/src/ApiServer/ApiServer.fs

@@ -163,6 +163,7 @@ let configureApp (packages : Packages) (appBuilder : WebApplication) =
   |> fun app ->
        LibService.Rollbar.AspNet.addRollbarToApp app rollbarCtxToMetadata None
   |> fun app -> app.UseHttpsRedirection()
+  |> fun app -> app.UseHsts()
   |> fun app -> app.UseRouting()
   // must go after UseRouting
   |> LibService.Kubernetes.configureApp LibService.Config.apiServerKubernetesPort
@@ -180,6 +181,7 @@ let configureServices (services : IServiceCollection) : unit =
        LibService.Telemetry.TraceDBQueries
   |> LibService.Kubernetes.configureServices [ LibBackend.Init.legacyServerCheck ]
   |> fun s -> s.AddServerTiming()
+  |> fun s -> s.AddHsts(LibService.HSTS.setConfig)
   |> ignore<IServiceCollection>
 
 let run (packages : Packages) : unit =

fsharp-backend/src/BwdServer/Server.fs

@@ -423,6 +423,10 @@ let configureApp (healthCheckPort : int) (app : IApplicationBuilder) =
     (task {
       let executionID = LibService.Telemetry.executionID ()
       ctx.Items[ "executionID" ] <- executionID
+      setHeader
+        ctx
+        "Strict-Transport-Security"
+        "max-age=31536000; includeSubDomains; preload"
       setHeader ctx "x-darklang-execution-id" (string executionID)
       setHeader ctx "Server" "darklang"
 

fsharp-backend/src/LibService/HSTS.fs

@@ -0,0 +1,9 @@
+module LibService.HSTS
+
+open System
+open Microsoft.AspNetCore.HttpsPolicy
+
+let setConfig (options : HstsOptions) =
+  options.Preload <- true
+  options.IncludeSubDomains <- true
+  options.MaxAge <- TimeSpan.FromDays 365

fsharp-backend/src/LibService/LibService.fsproj

@@ -22,6 +22,7 @@
     <Compile Include="Kubernetes.fs" />
     <Compile Include="HeapAnalytics.fs" />
     <Compile Include="Kestrel.fs" />
+    <Compile Include="HSTS.fs" />
     <Compile Include="Init.fs" />
   </ItemGroup>
   <ItemGroup>