3 files changed, 26 insertions, 5 deletions
diff --git a/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb b/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb
index dec9c60ef2..380a24a367 100644
--- a/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb
+++ b/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb
@@ -64,7 +64,7 @@ module ActionDispatch
     # <tt>:httponly</tt>.
     class CookieStore < AbstractStore
       def initialize(app, options={})
-        super(app, options.merge!(:cookie_only => true))
+        super(app, options.merge!(cookie_only: true))
       end
 
       def delete_session(req, session_id, options)
diff --git a/actionpack/lib/action_dispatch/middleware/ssl.rb b/actionpack/lib/action_dispatch/middleware/ssl.rb
index ab3077b308..0e04d3a524 100644
--- a/actionpack/lib/action_dispatch/middleware/ssl.rb
+++ b/actionpack/lib/action_dispatch/middleware/ssl.rb
@@ -18,17 +18,18 @@ module ActionDispatch
   #      Enabled by default. Configure `config.ssl_options` with `hsts: false` to disable.
   #
   # Set `config.ssl_options` with `hsts: { … }` to configure HSTS:
-  #   * `expires`: How long, in seconds, these settings will stick. Defaults to
-  #     `180.days` (recommended). The minimum required to qualify for browser
-  #     preload lists is `18.weeks`.
+  #   * `expires`: How long, in seconds, these settings will stick. The minimum
+  #     required to qualify for browser preload lists is `18.weeks`. Defaults to
+  #     `180.days` (recommended).
   #   * `subdomains`: Set to `true` to tell the browser to apply these settings
   #     to all subdomains. This protects your cookies from interception by a
-  #     vulnerable site on a subdomain. Defaults to `true`.
+  #     vulnerable site on a subdomain. Defaults to `false`.
   #   * `preload`: Advertise that this site may be included in browsers'
   #     preloaded HSTS lists. HSTS protects your site on every visit *except the
   #     first visit* since it hasn't seen your HSTS header yet. To close this
   #     gap, browser vendors include a baked-in list of HSTS-enabled sites.
   #     Go to https://hstspreload.appspot.com to submit your site for inclusion.
+  #     Defaults to `false`.
   #
   # To turn off HSTS, omitting the header is not enough. Browsers will remember the
   # original HSTS directive until it expires. Instead, use the header to tell browsers to
diff --git a/actionpack/test/dispatch/response_test.rb b/actionpack/test/dispatch/response_test.rb
index aa90433505..9eed796d3c 100644
--- a/actionpack/test/dispatch/response_test.rb
+++ b/actionpack/test/dispatch/response_test.rb
@@ -145,6 +145,26 @@ class ResponseTest < ActiveSupport::TestCase
     }, headers)
   end
 
+  test "content length" do
+    [100, 101, 102, 204].each do |c|
+      @response = ActionDispatch::Response.new
+      @response.status = c.to_s
+      @response.set_header "Content-Length", "0"
+      _, headers, _ = @response.to_a
+      assert !headers.has_key?("Content-Length"), "#{c} must not have a Content-Length header field"
+    end
+  end
+
+  test "does not contain a message-body" do
+    [100, 101, 102, 204, 304].each do |c|
+      @response = ActionDispatch::Response.new
+      @response.status = c.to_s
+      @response.body = "Body must not be included"
+      _, _, body = @response.to_a
+      assert_empty body, "#{c} must not have a message-body but actually contains #{body}"
+    end
+  end
+
   test "content type" do
     [204, 304].each do |c|
       @response = ActionDispatch::Response.new