File Coverage

blib/lib/Dancer/Plugin/RequireSSL.pm

Criterion	Covered	Total	%
statement	15	32	46.8
branch	0	6	0.0
condition	0	10	0.0
subroutine	5	10	50.0
pod			n/a
total	20	58	34.4

#
# This file is part of Dancer-Plugin-RequireSSL
#
# This software is copyright (c) 2012 by Natal Ngétal.
#
# This is free software; you can redistribute it and/or modify it under
# the same terms as the Perl 5 programming language system itself.
#
package Dancer::Plugin::RequireSSL;
{
  $Dancer::Plugin::RequireSSL::VERSION = '0.121370';
}

use strict;
use warnings;

use 5.010;

use Dancer ':syntax';
use Dancer::Plugin;

#ABSTRACT: Configure your application to redirect all incoming requests to HTTPS


register require_ssl => sub {
    hook before => sub {
        my $req = request;
        _redirect_to_ssl($req);
    };
    hook after => sub {
        _set_hsts_header();
    };
};

sub _redirect_to_ssl {
    my $req = shift;

    if ( ! request->secure
        && setting('environment') ne 'development' ) {
        if ( $req->base =~ /http:\/\//
            || $req->header('X-Forwarded-Proto') !~ 'https' ) {
            my $url = 'https://' . $req->host . $req->path;

            return redirect($url);
        }
    }
}

sub _set_hsts_header {
    my $settings    = plugin_setting;
    my $hsts_age    = $settings->{hsts_age} // 31536000;
    my $subdomains  = $settings->{hsts_include_subdomains} // 0;
    my $hsts_policy = "max-age=$hsts_age";

    $hsts_policy .= '; includeSubDomains' if $subdomains;

    header 'Strict-Transport-Security' => $hsts_policy;

    return;
}

register_plugin;

1;


__END__