OTWO-7711 CWE-319: HSTS header missing — config.force_ssl disabled in…

[Niharika1117]

… staging/prod

[Copilot]

Pull request overview

Enables HTTPS enforcement and HSTS in the Rails app’s staging and production environments to address missing HSTS header / disabled config.force_ssl.

Changes:

• Turn on config.force_ssl in staging and production.
• Add config.ssl_options to emit HSTS (initial max-age=300) and configure redirect exclusions for health/readiness probing.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
config/environments/staging.rb	Enables force_ssl and sets HSTS/redirect behavior for staging.
config/environments/production.rb	Enables force_ssl and sets HSTS/redirect behavior for production.

Suppressed comments (2)

config/environments/production.rb:54

• The SSL redirect exclusion is configured for /ready, but this app's health endpoint route is /health (config/routes.rb:35–36). With config.force_ssl = true, /health will still redirect to HTTPS and can cause readinessProbe redirect loops.

  config.ssl_options = {
    hsts: { expires: 300, subdomains: true },
    redirect: { exclude: ->(request) { request.path == '/ready' } }
  }

config/environments/staging.rb:54

• The SSL redirect exclusion is configured for /ready, but this app's health endpoint route is /health (config/routes.rb:35–36). With config.force_ssl = true, /health will still redirect to HTTPS and can cause readinessProbe redirect loops.

  config.ssl_options = {
    hsts: { expires: 300, subdomains: true },
    redirect: { exclude: ->(request) { request.path == '/ready' } }
  }

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.