<!--
	STS header specifies includeSubDomains.


	Insecure cookies are set for these hosts:

		- aalto.finna.fi
		- www.finna.fi

-->
<ruleset name="Finna.fi">

	<!--	Direct rewrites:
				-->
	<target host="finna.fi" />
	<target host="*.finna.fi" />

		<test url="http://aalto.finna.fi/" />
		<test url="http://piwik.finna.fi/" />
		<test url="http://www.finna.fi/" />


	<!--	Not secured by server:
					-->
	<!--securecookie host="^(?:aalto|www)\.finna\.fi$" name="^PHPSESSID$" /-->

	<securecookie host=".+" name=".+" />


	<rule from="^http:"
		to="https:" />

</ruleset>
