Invalidate existing HSTS headers

diff --git a/lib/base.php b/lib/base.php
index fd9a1d41121d3592018497cd08368974a89fddf8..ff95a87e4385904efe8c1e6ca7293194af8fea5c 100644 (file)
--- a/lib/base.php
+++ b/lib/base.php
@@ -231,6 +231,11 @@ class OC {
                                header("Location: $url");
                                exit();
                        }
+               } else {
+                       // Invalidate HSTS headers
+                       if (OC_Request::serverProtocol() === 'https') {
+                               header('Strict-Transport-Security: max-age=0');
+                       }
                }
        }