From 29bd2df28a5561f9d15a007775612be332bed376 Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Sat, 10 Oct 2026 09:31:25 +0400
Subject: [PATCH] bingo: send HSTS

The edge already redirects http:// to https://, but without HSTS the
first request of every visit can still go out in the clear. Turn on
Rack::Protection's StrictTransport for the bingo app: one year, this
host only, no preload.

Assisted-by: Claude:opus-5
---
 bingo_web.rb       | 2 ++
 test/bingo_test.rb | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/bingo_web.rb b/bingo_web.rb
index fea9a14..cf72a86 100644
--- a/bingo_web.rb
+++ b/bingo_web.rb
@@ -12,6 +12,8 @@ class BingoWeb < Sinatra::Base
     # the card needs none of it.
     set :static, false
     set :show_exceptions, $env == 'development'
+    # HSTS (1 year, this host only); http:// already 308s at the edge.
+    set :protection, use: %i[strict_transport]
     set :host_authorization,
         { permitted_hosts: $env == 'production' ? HOSTS : [] }
   end
diff --git a/test/bingo_test.rb b/test/bingo_test.rb
index 22a97e8..808d8af 100644
--- a/test/bingo_test.rb
+++ b/test/bingo_test.rb
@@ -216,6 +216,12 @@ class BingoTest < Minitest::Test
     assert_includes last_response.body, '<link rel="icon" href="/favicon.svg" type="image/svg+xml">'
   end
 
+  def test_hsts
+    get '/en'
+    assert_equal 'max-age=31536000', last_response.headers['strict-transport-security']
+    assert_equal 'nosniff', last_response.headers['x-content-type-options']
+  end
+
   def test_root_varies_on_language
     get '/'
     assert_equal 'Accept-Language', last_response.headers['Vary']