gaja-group
/
server-configs-nginx
mirror of https://github.com/h5bp/server-configs-nginx
2
0
Fork 0
Code Issues Releases Wiki Activity

Improve HSTS documentation 

Ref: https://github.com/h5bp/server-configs-apache/pull/196
This commit is contained in:
Léo Colombaro 2020-01-03 19:34:40 +01:00
parent 7a44fdf69f
commit 177a5e94a6
No known key found for this signature in database
GPG Key ID: 687B480A6D4F735F
1 changed files with 18 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
h5bp/security/strict-transport-security.conf
View File

@ -2,42 +2,37 @@
# | HTTP Strict Transport Security (HSTS) |
# ----------------------------------------------------------------------
# Force client-side SSL redirection.
# Force client-side TLS (Transport Layer Security) redirection.
#
# If a user types `example.com` in their browser, even if the server redirects
# them to the secure version of the website, that still leaves a window of
# opportunity (the initial HTTP connection) for an attacker to downgrade or
# redirect the request.
#
# The following header ensures that browser will ONLY connect to your server
# The following header ensures that browser only connects to your server
# via HTTPS, regardless of what the users type in the browser's address bar.
#
# (!) Be aware that this, once published, is not revokable and you must ensure
# being able to serve the site via SSL for the duration you've specified
# in max-age. When you don't have a valid SSL connection (anymore) your
# visitors will see a nasty error message even when attempting to connect
# via simple HTTP.
# (!) Be aware that Strict Transport Security is not revokable and you
# must ensure being able to serve the site over HTTPS for the duration
# you've specified in the `max-age` directive. When you don't have a
# valid TLS connection anymore (e.g. due to an expired TLS cerfiticate)
# your visitors will see a nasty error message even when attempting to
# connect over HTTP.
#
# (!) Remove the `includeSubDomains` optional directive if the website's
# subdomains are not using HTTPS.
# (1) Preloading Strict Transport Security.
# To submit your site for HSTS preloading, it is required that:
# * the `includeSubDomains` directive is specified
# * the `preload` directive is specified
# * the `max-age` is specified with a value of at least 31536000 seconds
# (1 year).
# https://hstspreload.org/#deployment-recommendations
#
# (1) If you want to submit your site for HSTS preload (2) you must
# * ensure the `includeSubDomains` directive to be present
# * the `preload` directive to be specified
# * the `max-age` to be at least 31536000 seconds (1 year) according to the
# current status.
#
# It is also advised (3) to only serve the HSTS header via a secure
# connection.
#
# (2) https://hstspreload.org/
# (3) https://tools.ietf.org/html/rfc6797#section-7.2
#
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
# https://tools.ietf.org/html/rfc6797#section-6.1
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
# https://www.html5rocks.com/en/tutorials/security/transport-layer-security/
# https://blogs.msdn.microsoft.com/ieinternals/2014/08/18/strict-transport-security/
# https://hstspreload.org/
add_header Strict-Transport-Security "max-age=16070400; includeSubDomains" always;
# (1) or if HSTS preloading is desired (respect (2) for current requirements):
# (1) Enable your site for HSTS preload inclusion.
# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;