class Rack::SSL

# File lib/rack/ssl.rb, line 8
def self.default_hsts_options
  { :expires => YEAR, :subdomains => false }
end

# File lib/rack/ssl.rb, line 12
def initialize(app, options = {})
  @app = app

  @hsts = options[:hsts]
  @hsts = {} if @hsts.nil? || @hsts == true
  @hsts = self.class.default_hsts_options.merge(@hsts) if @hsts

  @exclude = options[:exclude]
  @host    = options[:host]
end

# File lib/rack/ssl.rb, line 23
def call(env)
  if @exclude && @exclude.call(env)
    @app.call(env)
  elsif scheme(env) == 'https'
    status, headers, body = @app.call(env)
    headers = hsts_headers.merge(headers)
    flag_cookies_as_secure!(headers)
    [status, headers, body]
  else
    redirect_to_https(env)
  end
end