Questions tagged [hsts]

HTTP Strict Transport Security (HSTS) is a web security policy mechanism which helps to protect websites.

Filter by
Sorted by
Tagged with
0
votes
1answer
14 views

HSTS policy not preloaded on non www host

i am not very familiar with HSTS , but i try to implement it on my shared webhosting server. Seems i have gotten it to work on host with www. but not on apex host. Hardenize security audit flags it ...
0
votes
0answers
26 views

nginx reverse proxy problems with upstream server

I'm try to setup nginx reverse proxy for my company, I'm currently in test phase. This is schema what I have temporary. client---https-->nginx(VM1)---https-->backend(IIS 8)(VM2) My nginx.conf file. ...
-1
votes
2answers
52 views

Apache redirect with HSTS

I need to redirect all for example.com to https://www.example.com with HSTS turned on. How to do it? I got configuration in vhost80 and vhost443. What to fix in this code: in vhost 80 RewriteCond %{...
6
votes
1answer
789 views

Apache 2.4 - Disable HSTS Header [closed]

I've set up a Vagrant box with Ubuntu 18.04 and installed Apache 2.4.29. I've created and enabled a new conf file that looks like this: <VirtualHost *:80> ServerName django.dev ...
0
votes
0answers
25 views

How to provide http to a legacy application

Is there a way to filter out an url with cloudflare, and answer it with a static http content? My hosting solution does not allow http, and forwards all to https. One somewhat expensive solution ...
0
votes
0answers
23 views

HSTS sites broken with dnsmasq-based dns server?

I have run into this issue recently where if i'm using my local network's dns server (powered by dnsmasq), i get HSTS errors on many sites. However when this happens, i can change my local computer's ...
0
votes
1answer
34 views

How to avoid HSTS error by hosts redirect with self-signed certificate? [closed]

I created this records in windows hosts file 127.0.0.1 a.domain.name 127.0.0.1 b.domain.name 127.0.0.1 c.domain.name where 127.0.0.1 - ip of my server [a,b,c].domain.name - domains wich from i ...
1
vote
1answer
24 views

Nginx web server on VPS over HTTP - hsts

So I have been trying to serve a simple static web page over HTTP using Nginx 1.14.0 (Ubuntu). I am able to: curl the web page using both domain name and IP-address and find the web page in browser ...
0
votes
0answers
137 views

Tomcat 7.0.96 serving Strict-Transport-Security header on js but not on html content

I cannot understand very well how to configure Tomcat 7.0.96 to serve the Strict-Transport-Security header on any served file: we configured SSL (using a self signed certificate for testing pouposes) ...
1
vote
1answer
175 views

How can I allow http when on a specific subdomain with nginx? (HSTS)

I am trying to test my site on a stage site before making it live. Obviously it doesn't have the same certificate. When I try to going in with the testing.domain.com subdomain, I get this error in ...
0
votes
0answers
23 views

IMG loaded from HSTS domain on non-HTTPS site breaks site

Would HSTS cause an entire site (browser) to redirect to its HTTPS counterpart if a single (or more) resource from an HSTS domain was inserted into a HTTP site - e.g. through an 'img' tag? We have ...
1
vote
1answer
110 views

HTTP redirect (301, 302) with HSTS/.dev domain

I own a .dev domain, which is included on the HSTS preload list. The domain is registered with Namecheap. Now, when trying to set up redirects (301,302) from my www. to non-www, this is apparently ...
2
votes
1answer
862 views

nginx 1.15.10 - TLSv1.3 doesn't get applied despite the config

nginx -V nginx version: nginx/1.15.10 built by gcc 6.3.0 20170516 (Debian 6.3.0-18+deb9u1) built with OpenSSL 1.1.0j 20 Nov 2018 (running with OpenSSL 1.1.1b 26 Feb 2019) TLS SNI support enabled ...
1
vote
2answers
241 views

nginx fails to send HSTS headers despite being configured to do so

I'm setting up a site for myself using nginx and letsencrypt, and I wanted to set up HSTS preloading for the added security benefits, however when I check the url with multiple different scanners, ...
0
votes
1answer
561 views

SSLLabs: Strict Transport Security (HSTS): Server provided more than one HSTS header

CentOS 6.8 Apache 2.2 I have two websites running off this server (moodle and mahara). For some reason, the ssllabs tests come back fine for one of them (moodle) but for the mahara website, I get ...
1
vote
1answer
116 views

HSTS issues when redirecting to www. sub domain

I am trying to setup HSTS for my website but running into some problems regarding HSTS and the use of the www. sub domain. What I would like is for all HTTP and HTTPS traffic to redirect to https://...
1
vote
1answer
55 views

Nginx redirect to www

I have the same configuration on all my blocks yet only this one redirects to www while all my other redirects to non www. I think it may have to do something with the hsts that I've recently added ...
2
votes
2answers
2k views

Enable HTTP Strict Transport Header globally in HAProxy

I want to enable HTTP Strict Transport Security (HSTS) Headers globally for all my backends in HAProxy v1.5. Following the instructions from https://www.haproxy.com/blog/haproxy-and-http-strict-...
9
votes
1answer
1k views

HSTS and double redirect

I manage a little website in a shared hosting LAMP environment: this basically means the only thing I can edit is an htaccess file. I wanted to add HSTS support (and I did it), but, when I tested my ...
0
votes
2answers
800 views

HSTS: Is includeSubDomains on main domain sufficient?

In my Plesk web admin edition I just activated HSTS on my main domain www.domain.tld with add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; The test on ssllabs.com ...
7
votes
3answers
2k views

How does HSTS handle mixed content?

I've just checked with the SSL Server Test if I implemented the SSL certificate on my server correctly. I got a grade A in their ranking but you can get an A+ if you have activated HSTS. After some ...
1
vote
1answer
301 views

Apache: HSTS redirection on non-standard HTTP port causes SSL error [duplicate]

I've read a few answers on SF, and I'm no closer to a solution. My problem seems a little specific... Customers were accessing a webserver on port 81. With the general trend towards HTTPS, the ...
2
votes
1answer
329 views

Cloudflare: HSTS (Strict-Transport-Security) for subdomain only

I would like Cloudflare to send the HSTS header on the main domain, and on the www subdomain, but not the other subdomains. However I can only enable HSTS for the primary domain (and add ...
0
votes
1answer
1k views

Nginx - HSTS and Redirect non-www to www

I am checking the HSTS header here: https://hstspreload.org/ This is my non-www conf server { listen 443 server_name example.com; return 301 https://www.$server_name$request_uri; ##...
0
votes
1answer
993 views

how to disable HSTS in haproxy

I have a haproxy-ssl-terminated (haproxy 1.5.8 2014/10/31, debian jessie stock) test website, where the certificate expired. I'd like to be able to use the site while the new certificate arrives, but ...
1
vote
1answer
513 views

How to configure HSTS redirect prerequisites using CloudFront?

The HSTS Preload List Submission website has very specific prerequisites which disallow combining protocol changes and redirects into one step (classic example - redirecting requests for http://...
0
votes
0answers
897 views

Force redirect to url with captive portal or dnsmasq

We are trying to host a static webpage (just one index.php) on a local wifi network without internet access. Essentially every user (mobile devices) should land on some landing page where he can ...
1
vote
0answers
585 views

Using HSTS with Sub Domain Forwarding

Scanning a website using https://observatory.mozilla.org gives me the following error: Initial redirection from http to https is to a different host, preventing HSTS. Question Is this a genuine ...
0
votes
2answers
470 views

Mitigating HSTS Bypass

Friends, Is there any way to prevent HSTS bypass on Apache/RHEL environment. I have a webserver with valid SSL certificate for the domain. Non HTTPS requests are being redirected to HTTPS. Necessary ...
0
votes
1answer
578 views

HSTS with canonical URL redirect in nginx

I was using the nginx configuration taken from this post to implement redirect from http://(www.)example.com -> https://example.com: server { server_name www.example.com example.com; return ...
7
votes
3answers
2k views

hsts on main port 80, not on other ports

I have set hsts for my domain on the site http://server.mydom.tld:80, so the brower goes to port https://server.mydom.tld on port 443 However, I also have other webservers, running on other ports. So ...
0
votes
1answer
2k views

Using CNAME records to redirect to HTTPS when HSTS is active

We have a website running in HTTPS on the following URL: abc.example.com. The problem is that our client thought that any website URL should start with www and has printed www.abc.example.com on all ...
2
votes
0answers
1k views

How to configure HSTS in Wildfly the proper way?

I want to set the HSTS header on Wildfly. I haven't found any specific method to do this, so my first approach would be setting it manually via an undertow filter: <filters> <response-...
6
votes
3answers
11k views

Adding HSTS to nginx config

I recently changed my nginx config to redirect all http traffic to https (and all www traffic to no-www). Would it make sense to also add add_header Strict-Transport-Security "max-age=31536000; ...
0
votes
3answers
502 views

Ideally, how should HSTS / SSL Everywhere / Let's encrypt work with captive Wifi portals?

Some captive Wifi portals require the ability to 301/302 redirect a user to an authentication / terms of service page before permitting access to the Internet. This is at odds with SSL, which can't ...
0
votes
2answers
223 views

HSTS secured domain migration

I bought a domain from a stranger and it seems like he protected the domain with HSTS-preloading. Is HSTS bound to the specific certificate which was used when HSTS was activated or can I just create ...
3
votes
1answer
2k views

How can I enable HSTS on the default Google Load Balancer coming with Google Container Engine?

I'd love to set up HSTS with my GKE cluster, as right now HTTP requests return a Google broken robot 404 page after setting this up in ingress.yml annotations: kubernetes.io/ingress.allow-http: "false"...
0
votes
1answer
254 views

Configure Apache to send HSTS header only in virtual hosts using HTTPS

We have an Apache 2.4 server that runs numerous virtual hosts, some of which use http and some of which use https. I would like to send the same HSTS (Strict-Transport-Security) header only in those ...
0
votes
1answer
424 views

If I'm using HSTS on nginx, does the website force redirecting to HTTP?

I need to access some images and JS files through HTTP, but if I enable HSTS with add_header Strict-Transport-Security "max-age=31536000";, all files are served forcibly through HTTPS. So I used ...
4
votes
1answer
2k views

Mikrotik - redirecting YouTube to a local friendly page

I'm configuring a rb750. I would like to drop YouTube access and redirect to a friendly page located in our local webserver. I can drop using l7 firewall but I'm not able to redirect user because ...
1
vote
2answers
1k views

hsts apache 2.4 not triggering?

I've set up Apache to use HSTS as follows just for testing and learning purposes only: /etc/apache2/sites-enabled/000-default.conf NameVirtualHost 192.168.3.55:80 NameVirtualHost 192.168.3.55:443 ...
1
vote
1answer
77 views

Why must a HSTS header not be sent on HTTP

Why must a HSTS header not be sent on HTTP? What would it hurt; clients could take it as a hint to redirect to https.
49
votes
9answers
12k views

Is there any reason not to enforce HTTPS on a website?

A website I frequent have finally decided to enable TLS to their servers, only not to mandate it as a lot of websites out there do. The maintainer claims that TLS must be optional. Why? On my own ...
0
votes
1answer
575 views

Point a subdomain to a separate IP address using DNS/nginx

I'm trying to point a subdomain to a different IP address on a different server, but for some reason it's only working every once in awhile (say 1 out of 20 times). Browsing to http//galera.domain.com ...
0
votes
1answer
356 views

how do i send website traffic to an http port if i have Strict-Transport-Security enforced?

how do i send website traffic to an http port if i have Strict-Transport-Security is enforced For example i have Strict-Transport-Security enforced if i embed a link that leads to http port 8000 the ...
12
votes
4answers
7k views

HSTS on Amazon CloudFront from S3 origin

Is it possible to set HSTS headers on an Amazon CloudFront distribution from a S3 origin?
0
votes
1answer
54 views

SSL on CloudFront fails test

I'm hosting a static website on S3/Cloudfront. I have enabled SSL using an Amazon provided SSL certificate. Unfortunately, the setup seems to be failing the SSL tests. Any idea what could cause this?...
4
votes
1answer
859 views

HSTS header not being sent though rule is present and mod_headers is enabled

We enabled HSTS in httpd.conf in the Virtual Host handling port 443. We tried with and without the <IfModule mod_headers.c>: <IfModule mod_headers.c> Header set Strict-Transport-...
1
vote
2answers
2k views

Disable HSTS and HPKP

We have a domain with HSTS and HPKP enabled and working. For a few reasons, we would like to disable it, not immediately, but as soon as key expires. This means that the site would remain accessible ...
2
votes
2answers
2k views

Ignore HSTS in browser for a subdomain

[copied from https://stackoverflow.com/questions/39937837/] I've got my DNS set up to point local.example.com to 127.0.0.1. This is so that I can share cookies between the live site and my dev ...