Questions tagged [hsts]
HTTP Strict Transport Security (HSTS) is a web security policy mechanism which helps to protect websites.
57
questions
-1
votes
2
answers
48
views
Nginx forwarding presenting wrong certificate
I have a little problem with nginx. We have two subdomains we own, let's call them domain1.com and domain2.com. For domain2 we don't have further subdomains, for domain1 we have several. If someone ...
- 111
0
votes
0
answers
2k
views
IIS 10 will not redirect HTTP to HTTPS after enabling HSTS
I am attempting to force end users onto HTTPS when visiting our site. I have HSTS enabled in IIS at the site and application level. I have an HTTP redirect set up at the site level to https://...
- 101
0
votes
0
answers
23
views
thttpd support Strict Transport Security (HSTS) header
I try to understand if thttpd support header because my webserver doesn't show the HSTS and I don't think he use it and I want that he will do.
- 1
1
vote
1
answer
245
views
Securing Apache Solr on an Apache TLS / SSL server
I have a SSL-only website hosted on a CentOS 7, Apache httpd based server. SSL certification is via a Let's Encrypt certificate. The domain has a HTTP Strict Transport Security (HSTS) policy.
I am ...
- 111
1
vote
0
answers
892
views
IIS Version 1607 on Windows Server 2016 -- How to Add HTTP Strict Transport Security (HSTS) Support
Our servers are running Windows Server 2016 with IIS 1607. From what I can tell, this means the IIS 10 on the system is prior-to version 1709 where apparently Microsoft added the HSTS element under ...
- 133
6
votes
1
answer
4k
views
My browser will not display http://[sub.]example.com
When I go to http://sub.example.com in my browser I get a "connection refused" message or an "invalid certificate" error but I don't even want to connect over https.
As far as I ...
- 5,825
4
votes
0
answers
6k
views
Enabling HSTS header on AWS Application Load Balancer
We have a Spring Boot application behind an AWS Application Load Balancer. The load balancer terminates SSL before forwarding coming requests to our application and also redirects 80 port to 443 port.
...
0
votes
1
answer
417
views
I don't want HSTS on port 8001 but on other ports
I have hsts set for my domain in Nginx.conf . It will redirect my website to https for main port 80. But I don't want the redirect to happen for my other port. How do I do this?
- 1
2
votes
1
answer
1k
views
HSTS and Wordpress redirection to www and non-www and https - avoid multiple redirections?
I am trying to implement the HSTS (HTTP Strict Transport Security) on my Wordpress site, but I am not getting any success. First I had managed to redirect my site from non-www to www , and including ...
- 169
0
votes
1
answer
2k
views
Warning: Unnecessary HSTS header over HTTP
we would like to add the HSTS header to our page https://www.wipfelglueck.de
Our page is running on a shared server, so we don't have access to the httpd.conf. We tried to enable this header via the ....
4
votes
1
answer
673
views
How can I apply HSTS header to all vhosts over 443 in Apache
I'm looking to add the HSTS header in Apache...
# HSTS / Header Strict Transport Security
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
... but ...
- 557
0
votes
1
answer
216
views
HSTS policy not preloaded on non www host
i am not very familiar with HSTS , but i try to implement it on my shared webhosting server.
Seems i have gotten it to work on host with www. but not on apex host.
Hardenize security audit flags it ...
- 103
-1
votes
2
answers
1k
views
Apache redirect with HSTS
I need to redirect all for example.com to https://www.example.com with HSTS turned on. How to do it? I got configuration in vhost80 and vhost443. What to fix in this code:
in vhost 80
RewriteCond %{...
- 9
10
votes
1
answer
10k
views
Apache 2.4 - Disable HSTS Header [closed]
I've set up a Vagrant box with Ubuntu 18.04 and installed Apache 2.4.29. I've created and enabled a new conf file that looks like this:
<VirtualHost *:80>
ServerName django.dev
...
- 211
0
votes
1
answer
2k
views
How to avoid HSTS error by hosts redirect with self-signed certificate? [closed]
I created this records in windows hosts file
127.0.0.1 a.domain.name
127.0.0.1 b.domain.name
127.0.0.1 c.domain.name
where
127.0.0.1 - ip of my server
[a,b,c].domain.name - domains wich from i ...
1
vote
1
answer
51
views
Nginx web server on VPS over HTTP - hsts
So I have been trying to serve a simple static web page over HTTP using Nginx 1.14.0 (Ubuntu). I am able to: curl the web page using both domain name and IP-address
and find the web page in browser ...
- 21
1
vote
1
answer
2k
views
How can I allow http when on a specific subdomain with nginx? (HSTS)
I am trying to test my site on a stage site before making it live. Obviously it doesn't have the same certificate. When I try to going in with the testing.domain.com subdomain, I get this error in ...
- 307
0
votes
0
answers
71
views
IMG loaded from HSTS domain on non-HTTPS site breaks site
Would HSTS cause an entire site (browser) to redirect to its HTTPS counterpart if a single (or more) resource from an HSTS domain was inserted into a HTTP site - e.g. through an 'img' tag?
We have ...
- 260
1
vote
1
answer
482
views
HTTP redirect (301, 302) with HSTS/.dev domain
I own a .dev domain, which is included on the HSTS preload list.
The domain is registered with Namecheap.
Now, when trying to set up redirects (301,302) from my www. to non-www, this is apparently ...
- 111
2
votes
1
answer
2k
views
nginx 1.15.10 - TLSv1.3 doesn't get applied despite the config
nginx -V
nginx version: nginx/1.15.10
built by gcc 6.3.0 20170516 (Debian 6.3.0-18+deb9u1)
built with OpenSSL 1.1.0j 20 Nov 2018 (running with OpenSSL 1.1.1b 26 Feb 2019)
TLS SNI support enabled
...
user493649
1
vote
2
answers
2k
views
nginx fails to send HSTS headers despite being configured to do so
I'm setting up a site for myself using nginx and letsencrypt, and I wanted to set up HSTS preloading for the added security benefits, however when I check the url with multiple different scanners, ...
- 13
0
votes
1
answer
3k
views
SSLLabs: Strict Transport Security (HSTS): Server provided more than one HSTS header
CentOS 6.8
Apache 2.2
I have two websites running off this server (moodle and mahara). For some reason, the ssllabs tests come back fine for one of them (moodle) but for the mahara website, I get ...
- 133
1
vote
1
answer
426
views
HSTS issues when redirecting to www. sub domain
I am trying to setup HSTS for my website but running into some problems regarding HSTS and the use of the www. sub domain. What I would like is for all HTTP and HTTPS traffic to redirect to https://...
- 31
1
vote
1
answer
111
views
Nginx redirect to www
I have the same configuration on all my blocks yet only this one redirects to www while all my other redirects to non www. I think it may have to do something with the hsts that I've recently added ...
- 111
2
votes
2
answers
8k
views
Enable HTTP Strict Transport Header globally in HAProxy
I want to enable HTTP Strict Transport Security (HSTS) Headers globally for all my backends in HAProxy v1.5.
Following the instructions from https://www.haproxy.com/blog/haproxy-and-http-strict-...
- 3,121
9
votes
1
answer
3k
views
HSTS and double redirect
I manage a little website in a shared hosting LAMP environment: this basically means the only thing I can edit is an htaccess file.
I wanted to add HSTS support (and I did it), but, when I tested my ...
user487101
1
vote
2
answers
3k
views
HSTS: Is includeSubDomains on main domain sufficient?
In my Plesk web admin edition I just activated HSTS on my main domain www.domain.tld with
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
The test on ssllabs.com ...
- 185
7
votes
3
answers
3k
views
How does HSTS handle mixed content?
I've just checked with the SSL Server Test if I implemented the SSL certificate on my server correctly. I got a grade A in their ranking but you can get an A+ if you have activated HSTS. After some ...
- 185
1
vote
1
answer
849
views
Apache: HSTS redirection on non-standard HTTP port causes SSL error [duplicate]
I've read a few answers on SF, and I'm no closer to a solution. My problem seems a little specific...
Customers were accessing a webserver on port 81. With the general trend towards HTTPS, the ...
- 640
3
votes
1
answer
807
views
Cloudflare: HSTS (Strict-Transport-Security) for subdomain only
I would like Cloudflare to send the HSTS header on the main domain, and on the www subdomain, but not the other subdomains.
However I can only enable HSTS for the primary domain (and add ...
- 139
0
votes
1
answer
3k
views
Nginx - HSTS and Redirect non-www to www
I am checking the HSTS header here: https://hstspreload.org/
This is my non-www conf
server {
listen 443
server_name example.com;
return 301 https://www.$server_name$request_uri;
##...
0
votes
1
answer
2k
views
how to disable HSTS in haproxy
I have a haproxy-ssl-terminated (haproxy 1.5.8 2014/10/31, debian jessie stock) test website, where the certificate expired. I'd like to be able to use the site while the new certificate arrives, but ...
- 579
1
vote
1
answer
1k
views
How to configure HSTS redirect prerequisites using CloudFront?
The HSTS Preload List Submission website has very specific prerequisites which disallow combining protocol changes and redirects into one step (classic example - redirecting requests for http://...
- 301
0
votes
0
answers
2k
views
Force redirect to url with captive portal or dnsmasq
We are trying to host a static webpage (just one index.php) on a local wifi network without internet access. Essentially every user (mobile devices) should land on some landing page where he can ...
- 101
1
vote
0
answers
1k
views
Using HSTS with Sub Domain Forwarding
Scanning a website using https://observatory.mozilla.org gives me the following error: Initial redirection from http to https is to a different host, preventing HSTS.
Question
Is this a genuine issue ...
- 1,214
0
votes
2
answers
606
views
Mitigating HSTS Bypass
Friends,
Is there any way to prevent HSTS bypass on Apache/RHEL environment. I have a webserver with valid SSL certificate for the domain. Non HTTPS requests are being redirected to HTTPS. Necessary ...
- 11
0
votes
1
answer
1k
views
HSTS with canonical URL redirect in nginx
I was using the nginx configuration taken from this post to implement redirect from http://(www.)example.com -> https://example.com:
server {
server_name www.example.com example.com;
return ...
- 168
12
votes
3
answers
5k
views
hsts on main port 80, not on other ports
I have set hsts for my domain on the site http://server.mydom.tld:80, so the brower goes to port https://server.mydom.tld on port 443
However, I also have other webservers, running on other ports.
So ...
- 987
1
vote
1
answer
5k
views
Using CNAME records to redirect to HTTPS when HSTS is active
We have a website running in HTTPS on the following URL: abc.example.com.
The problem is that our client thought that any website URL should start with www and has printed www.abc.example.com on all ...
- 107
2
votes
0
answers
3k
views
How to configure HSTS in Wildfly the proper way?
I want to set the HSTS header on Wildfly. I haven't found any specific method to do this, so my first approach would be setting it manually via an undertow filter:
<filters>
<response-...
- 121
15
votes
3
answers
43k
views
Adding HSTS to nginx config
I recently changed my nginx config to redirect all http traffic to https (and all www traffic to no-www).
Would it make sense to also add add_header Strict-Transport-Security "max-age=31536000; ...
- 2,335
0
votes
3
answers
771
views
Ideally, how should HSTS / SSL Everywhere / Let's encrypt work with captive Wifi portals?
Some captive Wifi portals require the ability to 301/302 redirect a user to an authentication / terms of service page before permitting access to the Internet.
This is at odds with SSL, which can't ...
- 8,921
0
votes
2
answers
455
views
HSTS secured domain migration
I bought a domain from a stranger and it seems like he protected the domain with HSTS-preloading.
Is HSTS bound to the specific certificate which was used when HSTS was activated or can I just create ...
- 115
4
votes
3
answers
7k
views
How can I enable HSTS on the default Google Load Balancer coming with Google Container Engine?
I'd love to set up HSTS with my GKE cluster, as right now HTTP requests return a Google broken robot 404 page after setting this up in ingress.yml annotations:
kubernetes.io/ingress.allow-http: "false"...
- 165
0
votes
1
answer
483
views
Configure Apache to send HSTS header only in virtual hosts using HTTPS
We have an Apache 2.4 server that runs numerous virtual hosts, some of which use http and some of which use https. I would like to send the same HSTS (Strict-Transport-Security) header only in those ...
- 2,681
0
votes
1
answer
782
views
If I'm using HSTS on nginx, does the website force redirecting to HTTP?
I need to access some images and JS files through HTTP, but if I enable HSTS with add_header Strict-Transport-Security "max-age=31536000";, all files are served forcibly through HTTPS.
So I used ...
- 1
4
votes
1
answer
3k
views
Mikrotik - redirecting YouTube to a local friendly page
I'm configuring a rb750. I would like to drop YouTube access and redirect to a friendly page located in our local webserver. I can drop using l7 firewall but I'm not able to redirect user because ...
1
vote
2
answers
2k
views
hsts apache 2.4 not triggering?
I've set up Apache to use HSTS as follows just for testing and learning purposes only:
/etc/apache2/sites-enabled/000-default.conf
NameVirtualHost 192.168.3.55:80
NameVirtualHost 192.168.3.55:443
...
- 621
1
vote
1
answer
281
views
Why must a HSTS header not be sent on HTTP
Why must a HSTS header not be sent on HTTP?
What would it hurt; clients could take it as a hint to redirect to https.
- 987
49
votes
9
answers
16k
views
Is there any reason not to enforce HTTPS on a website?
A website I frequent have finally decided to enable TLS to their servers, only not to mandate it as a lot of websites out there do. The maintainer claims that TLS must be optional. Why?
On my own ...
- 649