Misskey: Allow option to disable sending HSTS headers even if https:// is used in url

[incognico]

Summary

Allow option to disable sending HSTS headers even if https:// is used

I'm using a webserver as proxy which does HTTPS and HSTS, Misskey is communicating in HTTP with the webserver. But I have set "url" to https:// so that images etc. internally are HTTPS and do not need to be rewritten by the webserver every time. This works fine that way but it sends a duplicate HSTS header.

https://github.com/syuilo/misskey/blob/80daf7c749298b72cd5722f81bcb8c9c543b3c52/src/server/index.ts#L44

Maybe a new option "hsts: false" in the config? That would be enough.

[syuilo]

Thank you for your suggestion.
I will implement it!

[incognico]

Weird, I can't login anymore now. But it is regardless of the disableHsts setting.

It says wrong user/pass but its correct.

Error 500 for POST to /api/signin

  Error: Cannot send secure cookie over unencrypted connection
      at Cookies.set (/usr/home/misskey/misskey/node_modules/cookies/index.js:94:11)
      at Object.default_1 [as default] (/usr/home/misskey/misskey/built/server/api/common/signin.js:6:17)
      at exports.default (/usr/home/misskey/misskey/built/server/api/private/signin.js:64:29)

Did I break something? D:

[syuilo]

I just disabled secure flag in v10.22.1

[incognico]

Awesome, works!