6

My company's site has a static homepage for speed and cost reasons. We use S3 as the origin for CloudFront. Now, we would like to declare Strict-Transport-Security for the entire domain, but S3 seems to not send any headers we specify (beyond ones starting with like x-aws--). CloudFront doesn't seem to have any custom header option either.

Is this possible?

|improve this question
  • Not directly possible, though there are some conceivable workarounds... what benefit does HTTP STS give you, though, if the site is 100% static? Or are you wanting it on the "entire domain" for side effects... in the sense that a request directed to the main site will (?) also impose STS on all subdomains? – Michael - sqlbot Sep 22 '14 at 10:52
  • 1
    Michael While the homepage is static, our backend is not. It's on a subdomain. Yeah, that's the goal. – StackExchange User Sep 22 '14 at 11:42
0

Starting 7/16/2017, the functionality you were looking for is available via Lambda@Edge, see http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-at-the-edge.html for general documentation, or a specific example at https://nvisium.com/blog/2017/08/10/lambda-edge-cloudfront-custom-headers/

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.