Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hsts]

HTTP Strict Transport Security (HSTS) is a web security policy mechanism which helps to protect websites.

0
votes
0answers
21 views

Nginx Redirect to non-www doesn't work like expected

I have 5 different blocks with the same config file all they redirects www to non-www but this one does the opposite redirects non-www to www. Yet it has the same config file which is this one: ...
1
vote
1answer
37 views

Nginx redirect to www

I have the same configuration on all my blocks yet only this one redirects to www while all my other redirects to non www. I think it may have to do something with the hsts that I've recently added ...
2
votes
1answer
57 views

Enable HTTP Strict Transport Header globally in HAProxy

I want to enable HTTP Strict Transport Security (HSTS) Headers globally for all my backends in HAProxy v1.5. Following the instructions from https://www.haproxy.com/blog/haproxy-and-http-strict-...
0
votes
0answers
14 views

Enable HSTS on Google Load Balancer

I'm currently trying to enable the hsts header on my teams Google load balancer. I do not see any options for the enabling of this header on the menu. I have done some digging and found this ...
8
votes
1answer
656 views

HSTS and double redirect

I manage a little website in a shared hosting LAMP environment: this basically means the only thing I can edit is an htaccess file. I wanted to add HSTS support (and I did it), but, when I tested my ...
0
votes
2answers
24 views

HSTS: Is includeSubDomains on main domain sufficient?

In my Plesk web admin edition I just activated HSTS on my main domain www.domain.tld with add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; The test on ssllabs.com ...
7
votes
3answers
780 views

How does HSTS handle mixed content?

I've just checked with the SSL Server Test if I implemented the SSL certificate on my server correctly. I got a grade A in their ranking but you can get an A+ if you have activated HSTS. After some ...
0
votes
1answer
66 views

Apache: HSTS redirection on non-standard HTTP port causes SSL error [duplicate]

I've read a few answers on SF, and I'm no closer to a solution. My problem seems a little specific... Customers were accessing a webserver on port 81. With the general trend towards HTTPS, the ...
2
votes
1answer
101 views

Cloudflare: HSTS (Strict-Transport-Security) for subdomain only

I would like Cloudflare to send the HSTS header on the main domain, and on the www subdomain, but not the other subdomains. However I can only enable HSTS for the primary domain (and add ...
0
votes
1answer
221 views

Nginx - HSTS and Redirect non-www to www

I am checking the HSTS header here: https://hstspreload.org/ This is my non-www conf server { listen 443 server_name example.com; return 301 https://www.$server_name$request_uri; ##...
0
votes
1answer
359 views

how to disable HSTS in haproxy

I have a haproxy-ssl-terminated (haproxy 1.5.8 2014/10/31, debian jessie stock) test website, where the certificate expired. I'd like to be able to use the site while the new certificate arrives, but ...
0
votes
1answer
151 views

How to configure HSTS redirect prerequisites using CloudFront?

The HSTS Preload List Submission website has very specific prerequisites which disallow combining protocol changes and redirects into one step (classic example - redirecting requests for http://...
0
votes
0answers
312 views

Force redirect to url with captive portal or dnsmasq

We are trying to host a static webpage (just one index.php) on a local wifi network without internet access. Essentially every user (mobile devices) should land on some landing page where he can ...
1
vote
0answers
204 views

Using HSTS with Sub Domain Forwarding

Scanning a website using https://observatory.mozilla.org gives me the following error: Initial redirection from http to https is to a different host, preventing HSTS. Question Is this a genuine ...
0
votes
0answers
203 views

How do I configure HSTS for Keycloak welcome page?

I would like to modify the HTTP Strict-Transport-Security response headers for my entire Keycloak service. I was able to locate and modify HSTS settings per realm (under Realm Settings > Security ...
0
votes
2answers
302 views

Mitigating HSTS Bypass

Friends, Is there any way to prevent HSTS bypass on Apache/RHEL environment. I have a webserver with valid SSL certificate for the domain. Non HTTPS requests are being redirected to HTTPS. Necessary ...
0
votes
1answer
277 views

HSTS with canonical URL redirect in nginx

I was using the nginx configuration taken from this post to implement redirect from http://(www.)example.com -> https://example.com: server { server_name www.example.com example.com; return ...
2
votes
1answer
527 views

hsts on main port 80, not on other ports

I have set hsts for my domain on the site http://server.mydom.tld:80, so the brower goes to port https://server.mydom.tld on port 443 However, I also have other webservers, running on other ports. So ...
0
votes
1answer
840 views

Using CNAME records to redirect to HTTPS when HSTS is active

We have a website running in HTTPS on the following URL: abc.example.com. The problem is that our client thought that any website URL should start with www and has printed www.abc.example.com on all ...
2
votes
0answers
374 views

How to configure HSTS in Wildfly the proper way?

I want to set the HSTS header on Wildfly. I haven't found any specific method to do this, so my first approach would be setting it manually via an undertow filter: <filters> <response-...
2
votes
1answer
3k views

Adding HSTS to nginx config

I recently changed my nginx config to redirect all http traffic to https (and all www traffic to no-www). Would it make sense to also add add_header Strict-Transport-Security "max-age=31536000; ...
0
votes
3answers
201 views

Ideally, how should HSTS / SSL Everywhere / Let's encrypt work with captive Wifi portals?

Some captive Wifi portals require the ability to 301/302 redirect a user to an authentication / terms of service page before permitting access to the Internet. This is at odds with SSL, which can't ...
0
votes
2answers
92 views

HSTS secured domain migration

I bought a domain from a stranger and it seems like he protected the domain with HSTS-preloading. Is HSTS bound to the specific certificate which was used when HSTS was activated or can I just create ...
2
votes
1answer
657 views

How can I enable HSTS on the default Google Load Balancer coming with Google Container Engine?

I'd love to set up HSTS with my GKE cluster, as right now HTTP requests return a Google broken robot 404 page after setting this up in ingress.yml annotations: kubernetes.io/ingress.allow-http: "false"...
0
votes
1answer
102 views

Configure Apache to send HSTS header only in virtual hosts using HTTPS

We have an Apache 2.4 server that runs numerous virtual hosts, some of which use http and some of which use https. I would like to send the same HSTS (Strict-Transport-Security) header only in those ...
0
votes
1answer
232 views

If I'm using HSTS on nginx, does the website force redirecting to HTTP?

I need to access some images and JS files through HTTP, but if I enable HSTS with add_header Strict-Transport-Security "max-age=31536000";, all files are served forcibly through HTTPS. So I used ...
3
votes
1answer
1k views

Mikrotik - redirecting YouTube to a local friendly page

I'm configuring a rb750. I would like to drop YouTube access and redirect to a friendly page located in our local webserver. I can drop using l7 firewall but I'm not able to redirect user because ...
1
vote
2answers
526 views

hsts apache 2.4 not triggering?

I've set up Apache to use HSTS as follows just for testing and learning purposes only: /etc/apache2/sites-enabled/000-default.conf NameVirtualHost 192.168.3.55:80 NameVirtualHost 192.168.3.55:443 ...
1
vote
1answer
54 views

Why must a HSTS header not be sent on HTTP

Why must a HSTS header not be sent on HTTP? What would it hurt; clients could take it as a hint to redirect to https.
49
votes
9answers
10k views

Is there any reason not to enforce HTTPS on a website?

A website I frequent have finally decided to enable TLS to their servers, only not to mandate it as a lot of websites out there do. The maintainer claims that TLS must be optional. Why? On my own ...
0
votes
1answer
389 views

Point a subdomain to a separate IP address using DNS/nginx

I'm trying to point a subdomain to a different IP address on a different server, but for some reason it's only working every once in awhile (say 1 out of 20 times). Browsing to http//galera.domain.com ...
1
vote
1answer
168 views

how do i send website traffic to an http port if i have Strict-Transport-Security enforced?

how do i send website traffic to an http port if i have Strict-Transport-Security is enforced For example i have Strict-Transport-Security enforced if i embed a link that leads to http port 8000 the ...
7
votes
4answers
4k views

HSTS on Amazon CloudFront from S3 origin

Is it possible to set HSTS headers on an Amazon CloudFront distribution from a S3 origin?
0
votes
1answer
51 views

SSL on CloudFront fails test

I'm hosting a static website on S3/Cloudfront. I have enabled SSL using an Amazon provided SSL certificate. Unfortunately, the setup seems to be failing the SSL tests. Any idea what could cause this?...
4
votes
1answer
544 views

HSTS header not being sent though rule is present and mod_headers is enabled

We enabled HSTS in httpd.conf in the Virtual Host handling port 443. We tried with and without the <IfModule mod_headers.c>: <IfModule mod_headers.c> Header set Strict-Transport-...
1
vote
2answers
1k views

Disable HSTS and HPKP

We have a domain with HSTS and HPKP enabled and working. For a few reasons, we would like to disable it, not immediately, but as soon as key expires. This means that the site would remain accessible ...
2
votes
2answers
1k views

Ignore HSTS in browser for a subdomain

[copied from https://stackoverflow.com/questions/39937837/] I've got my DNS set up to point local.example.com to 127.0.0.1. This is so that I can share cookies between the live site and my dev ...