Fix HSTS header formatting by removing colon+space

[homestar9]

Fixes malformed header output

Issues

BOX-176

Type of change

Please delete options that are not relevant.

• Bug Fix

[Copilot]

🔵 Needs a closer look

The updated HSTS header logic can still emit an invalid directive sequence when both includeSubDomains and preload are enabled (missing ; separator before preload).

Pull request overview

This PR updates the Strict-Transport-Security (HSTS) header construction in the SecurityHeaders interceptor to correct malformed output so the header is emitted in a standards-compliant format.

Changes:

• Fixes HSTS max-age directive formatting by using max-age=<value> instead of max-age: <value>.
• (Recommended) Ensures optional HSTS directives are properly separated with semicolons when multiple directives are present.

File summaries

File	Description
interceptors/SecurityHeaders.cfc	Adjusts HSTS header value formatting in postProcess() to prevent malformed Strict-Transport-Security output.

Review details

Suppressed comments (1)

interceptors/SecurityHeaders.cfc:257

• When both includeSubDomains and preload are enabled, the header becomes max-age=...; includeSubDomains preload (missing a ; separator before preload), which is not valid Strict-Transport-Security directive formatting. Build the value without a trailing semicolon on max-age and append each optional directive with ; ....

			var headerValue = "max-age=#variables.settings.securityHeaders.hsts[ "max-age" ]#;";
			if ( variables.settings.securityHeaders.hsts.includeSubDomains ) {
				headerValue &= " includeSubDomains";
			}
			if ( variables.settings.securityHeaders.hsts.preload ) {

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.