From 9727b8cff357e13bb54022876275c61736ac8e40 Mon Sep 17 00:00:00 2001 From: Dave L Date: Fri, 18 Sep 2026 11:52:55 -0700 Subject: [PATCH 1/2] Fix HSTS header formatting by removing colon+space https://ortussolutions.atlassian.net/browse/BOX-176 Fixes malformed header output --- interceptors/SecurityHeaders.cfc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/interceptors/SecurityHeaders.cfc b/interceptors/SecurityHeaders.cfc index 978031a..9325fd1 100644 --- a/interceptors/SecurityHeaders.cfc +++ b/interceptors/SecurityHeaders.cfc @@ -250,7 +250,7 @@ component extends="coldbox.system.Interceptor" { } if ( variables.settings.securityHeaders.hsts.enabled ) { - var headerValue = "max-age: #variables.settings.securityHeaders.hsts[ "max-age" ]#;"; + var headerValue = "max-age=#variables.settings.securityHeaders.hsts[ "max-age" ]#;"; if ( variables.settings.securityHeaders.hsts.includeSubDomains ) { headerValue &= " includeSubDomains"; } From 5b95c9f098286b480df0a3c2188b5cecdaafbe13 Mon Sep 17 00:00:00 2001 From: Dave L Date: Fri, 18 Sep 2026 11:59:02 -0700 Subject: [PATCH 2/2] Fix HSTS header value formatting Fixed semicolon --- interceptors/SecurityHeaders.cfc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/interceptors/SecurityHeaders.cfc b/interceptors/SecurityHeaders.cfc index 9325fd1..0ffecf2 100644 --- a/interceptors/SecurityHeaders.cfc +++ b/interceptors/SecurityHeaders.cfc @@ -250,12 +250,12 @@ component extends="coldbox.system.Interceptor" { } if ( variables.settings.securityHeaders.hsts.enabled ) { - var headerValue = "max-age=#variables.settings.securityHeaders.hsts[ "max-age" ]#;"; + var headerValue = "max-age=#variables.settings.securityHeaders.hsts[ "max-age" ]#"; if ( variables.settings.securityHeaders.hsts.includeSubDomains ) { - headerValue &= " includeSubDomains"; + headerValue &= "; includeSubDomains"; } if ( variables.settings.securityHeaders.hsts.preload ) { - headerValue &= " preload"; + headerValue &= "; preload"; } event.setHTTPHeader( name: "Strict-Transport-Security", value: headerValue ); }