package org.skyve.impl.web.filter;

import java.io.IOException;
import java.util.Enumeration;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletResponse;

import org.skyve.util.Util;

public class ResponseHeaderFilter implements Filter {
	FilterConfig fc;

	@Override
	public void init(FilterConfig config) throws ServletException {
		fc = config;
	}

	@Override
	public void destroy() {
		fc = null;
	}

	@Override
	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
	throws IOException, ServletException {
		HttpServletResponse httpResponse = (HttpServletResponse) response;

		// set the provided HTTP response parameters
		for (Enumeration<?> e = fc.getInitParameterNames(); e.hasMoreElements();) {
			String headerName = (String) e.nextElement();
			if ("Expires".equals(headerName)) {
				httpResponse.addDateHeader("Expires", System.currentTimeMillis() + Long.parseLong(fc.getInitParameter(headerName)));
			}
			// only apply HSTS header if defined and we are using TLS
			else if (Util.isSecureUrl() && "Strict-Transport-Security".equals(headerName)) {
				httpResponse.addHeader(headerName, fc.getInitParameter(headerName));
			}
			else {
				httpResponse.addHeader(headerName, fc.getInitParameter(headerName));
			}
		}

		// pass the request/response on
		chain.doFilter(request, httpResponse);
	}
}

@@ -1226,30 +1226,8 @@
 if (
-Util.isSecureUrl() && 
 %22Str
@@ -1264,32 +1264,63 @@
 (headerName)) %7B%0A
+%09%09%09%09if (Util.isSecureUrl()) %7B%0A%09
 %09%09%09%09httpResponse
@@ -1372,24 +1372,30 @@
 aderName));%0A
+%09%09%09%09%7D%0A
 %09%09%09%7D%0A%09%09%09else

Fix HSTS logic in ResponseHeaderFilter.