{"action":"closed","issue":{"url":"https://api.github.com/repos/rails/rails/issues/25630","repository_url":"https://api.github.com/repos/rails/rails","labels_url":"https://api.github.com/repos/rails/rails/issues/25630/labels{/name}","comments_url":"https://api.github.com/repos/rails/rails/issues/25630/comments","events_url":"https://api.github.com/repos/rails/rails/issues/25630/events","html_url":"https://github.com/rails/rails/issues/25630","id":163442803,"number":25630,"title":"config.force_ssl ignores hsts preload option","user":{"login":"rbrownejr","id":5497834,"avatar_url":"https://avatars.githubusercontent.com/u/5497834?v=3","gravatar_id":"","url":"https://api.github.com/users/rbrownejr","html_url":"https://github.com/rbrownejr","followers_url":"https://api.github.com/users/rbrownejr/followers","following_url":"https://api.github.com/users/rbrownejr/following{/other_user}","gists_url":"https://api.github.com/users/rbrownejr/gists{/gist_id}","starred_url":"https://api.github.com/users/rbrownejr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rbrownejr/subscriptions","organizations_url":"https://api.github.com/users/rbrownejr/orgs","repos_url":"https://api.github.com/users/rbrownejr/repos","events_url":"https://api.github.com/users/rbrownejr/events{/privacy}","received_events_url":"https://api.github.com/users/rbrownejr/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rails/rails/labels/actionpack","name":"actionpack","color":"FFF700"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-07-01T17:44:06Z","updated_at":"2016-07-02T01:59:53Z","closed_at":"2016-07-02T01:59:53Z","body":"### Steps to reproduce\r\nIn your conf/environments/production.rb set config.force_ssl = true and set config.ssl_options = { hsts: {expires: 15552000, subdomains: true, preload: true} }\r\n\r\nLaunched app in production mode and did a curl -v https://mydomain.com.\r\n\r\n(Guidelines for creating a bug report are [available\r\nhere](http://guides.rubyonrails.org/contributing_to_ruby_on_rails.html#creating-a-bug-report))\r\n\r\n### Expected behavior\r\nTell us what should happen\r\n\r\nThe returning Strict-Transport-Security header should read \"max-age=15552000; includeSubDomains; preload\"\r\n\r\n### Actual behavior\r\nTell us what happens instead\r\n\r\nInstead you get \"max-age=15552000; includeSubDomains\"\r\n\r\nIt appears config.force_ssl is ignoring the preload when it's creating the header.\r\n\r\n### System configuration\r\n**Rails version**:\r\n4.2.6\r\n\r\n**Ruby version**:\r\n2.3.1p112"}}
{"actor":{"display_login":"rafaelfranca"}}