Questions tagged [hsts]

HTTP Strict Transport Security (HSTS) is a web security policy mechanism which helps to protect websites.

Filter by
Sorted by
Tagged with
1
vote
0answers
100 views

Enabling HSTS header on AWS Application Load Balancer

We have a Spring Boot application behind an AWS Application Load Balancer. The load balancer terminates SSL before forwarding coming requests to our application and also redirects 80 port to 443 port. ...
0
votes
1answer
42 views

I don't want HSTS on port 8001 but on other ports

I have hsts set for my domain in Nginx.conf . It will redirect my website to https for main port 80. But I don't want the redirect to happen for my other port. How do I do this?
1
vote
1answer
198 views

HSTS and Wordpress redirection to www and non-www and https - avoid multiple redirections?

I am trying to implement the HSTS (HTTP Strict Transport Security) on my Wordpress site, but I am not getting any success. First I had managed to redirect my site from non-www to www , and including ...
0
votes
1answer
491 views

Warning: Unnecessary HSTS header over HTTP

we would like to add the HSTS header to our page https://www.wipfelglueck.de Our page is running on a shared server, so we don't have access to the httpd.conf. We tried to enable this header via the ....
1
vote
1answer
95 views

How can I apply HSTS header to all vhosts over 443 in Apache

I'm looking to add the HSTS header in Apache... # HSTS / Header Strict Transport Security Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" ... but ...
0
votes
1answer
61 views

HSTS policy not preloaded on non www host

i am not very familiar with HSTS , but i try to implement it on my shared webhosting server. Seems i have gotten it to work on host with www. but not on apex host. Hardenize security audit flags it ...
-1
votes
2answers
478 views

Apache redirect with HSTS

I need to redirect all for example.com to https://www.example.com with HSTS turned on. How to do it? I got configuration in vhost80 and vhost443. What to fix in this code: in vhost 80 RewriteCond %{...
8
votes
1answer
5k views

Apache 2.4 - Disable HSTS Header [closed]

I've set up a Vagrant box with Ubuntu 18.04 and installed Apache 2.4.29. I've created and enabled a new conf file that looks like this: <VirtualHost *:80> ServerName django.dev ...
0
votes
1answer
262 views

How to avoid HSTS error by hosts redirect with self-signed certificate? [closed]

I created this records in windows hosts file 127.0.0.1 a.domain.name 127.0.0.1 b.domain.name 127.0.0.1 c.domain.name where 127.0.0.1 - ip of my server [a,b,c].domain.name - domains wich from i ...
1
vote
1answer
27 views

Nginx web server on VPS over HTTP - hsts

So I have been trying to serve a simple static web page over HTTP using Nginx 1.14.0 (Ubuntu). I am able to: curl the web page using both domain name and IP-address and find the web page in browser ...
1
vote
1answer
703 views

How can I allow http when on a specific subdomain with nginx? (HSTS)

I am trying to test my site on a stage site before making it live. Obviously it doesn't have the same certificate. When I try to going in with the testing.domain.com subdomain, I get this error in ...
0
votes
0answers
39 views

IMG loaded from HSTS domain on non-HTTPS site breaks site

Would HSTS cause an entire site (browser) to redirect to its HTTPS counterpart if a single (or more) resource from an HSTS domain was inserted into a HTTP site - e.g. through an 'img' tag? We have ...
1
vote
1answer
162 views

HTTP redirect (301, 302) with HSTS/.dev domain

I own a .dev domain, which is included on the HSTS preload list. The domain is registered with Namecheap. Now, when trying to set up redirects (301,302) from my www. to non-www, this is apparently ...
2
votes
1answer
1k views

nginx 1.15.10 - TLSv1.3 doesn't get applied despite the config

nginx -V nginx version: nginx/1.15.10 built by gcc 6.3.0 20170516 (Debian 6.3.0-18+deb9u1) built with OpenSSL 1.1.0j 20 Nov 2018 (running with OpenSSL 1.1.1b 26 Feb 2019) TLS SNI support enabled ...
1
vote
2answers
562 views

nginx fails to send HSTS headers despite being configured to do so

I'm setting up a site for myself using nginx and letsencrypt, and I wanted to set up HSTS preloading for the added security benefits, however when I check the url with multiple different scanners, ...
0
votes
1answer
2k views

SSLLabs: Strict Transport Security (HSTS): Server provided more than one HSTS header

CentOS 6.8 Apache 2.2 I have two websites running off this server (moodle and mahara). For some reason, the ssllabs tests come back fine for one of them (moodle) but for the mahara website, I get ...
1
vote
1answer
187 views

HSTS issues when redirecting to www. sub domain

I am trying to setup HSTS for my website but running into some problems regarding HSTS and the use of the www. sub domain. What I would like is for all HTTP and HTTPS traffic to redirect to https://...
1
vote
1answer
55 views

Nginx redirect to www

I have the same configuration on all my blocks yet only this one redirects to www while all my other redirects to non www. I think it may have to do something with the hsts that I've recently added ...
2
votes
2answers
4k views

Enable HTTP Strict Transport Header globally in HAProxy

I want to enable HTTP Strict Transport Security (HSTS) Headers globally for all my backends in HAProxy v1.5. Following the instructions from https://www.haproxy.com/blog/haproxy-and-http-strict-...
9
votes
1answer
2k views

HSTS and double redirect

I manage a little website in a shared hosting LAMP environment: this basically means the only thing I can edit is an htaccess file. I wanted to add HSTS support (and I did it), but, when I tested my ...
1
vote
2answers
1k views

HSTS: Is includeSubDomains on main domain sufficient?

In my Plesk web admin edition I just activated HSTS on my main domain www.domain.tld with add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; The test on ssllabs.com ...
7
votes
3answers
2k views

How does HSTS handle mixed content?

I've just checked with the SSL Server Test if I implemented the SSL certificate on my server correctly. I got a grade A in their ranking but you can get an A+ if you have activated HSTS. After some ...
1
vote
1answer
484 views

Apache: HSTS redirection on non-standard HTTP port causes SSL error [duplicate]

I've read a few answers on SF, and I'm no closer to a solution. My problem seems a little specific... Customers were accessing a webserver on port 81. With the general trend towards HTTPS, the ...
2
votes
1answer
486 views

Cloudflare: HSTS (Strict-Transport-Security) for subdomain only

I would like Cloudflare to send the HSTS header on the main domain, and on the www subdomain, but not the other subdomains. However I can only enable HSTS for the primary domain (and add ...
0
votes
1answer
2k views

Nginx - HSTS and Redirect non-www to www

I am checking the HSTS header here: https://hstspreload.org/ This is my non-www conf server { listen 443 server_name example.com; return 301 https://www.$server_name$request_uri; ##...
0
votes
1answer
1k views

how to disable HSTS in haproxy

I have a haproxy-ssl-terminated (haproxy 1.5.8 2014/10/31, debian jessie stock) test website, where the certificate expired. I'd like to be able to use the site while the new certificate arrives, but ...
1
vote
1answer
894 views

How to configure HSTS redirect prerequisites using CloudFront?

The HSTS Preload List Submission website has very specific prerequisites which disallow combining protocol changes and redirects into one step (classic example - redirecting requests for http://...
0
votes
0answers
1k views

Force redirect to url with captive portal or dnsmasq

We are trying to host a static webpage (just one index.php) on a local wifi network without internet access. Essentially every user (mobile devices) should land on some landing page where he can ...
1
vote
0answers
783 views

Using HSTS with Sub Domain Forwarding

Scanning a website using https://observatory.mozilla.org gives me the following error: Initial redirection from http to https is to a different host, preventing HSTS. Question Is this a genuine issue ...
0
votes
2answers
525 views

Mitigating HSTS Bypass

Friends, Is there any way to prevent HSTS bypass on Apache/RHEL environment. I have a webserver with valid SSL certificate for the domain. Non HTTPS requests are being redirected to HTTPS. Necessary ...
0
votes
1answer
663 views

HSTS with canonical URL redirect in nginx

I was using the nginx configuration taken from this post to implement redirect from http://(www.)example.com -> https://example.com: server { server_name www.example.com example.com; return ...
10
votes
3answers
3k views

hsts on main port 80, not on other ports

I have set hsts for my domain on the site http://server.mydom.tld:80, so the brower goes to port https://server.mydom.tld on port 443 However, I also have other webservers, running on other ports. So ...
0
votes
1answer
2k views

Using CNAME records to redirect to HTTPS when HSTS is active

We have a website running in HTTPS on the following URL: abc.example.com. The problem is that our client thought that any website URL should start with www and has printed www.abc.example.com on all ...
2
votes
0answers
2k views

How to configure HSTS in Wildfly the proper way?

I want to set the HSTS header on Wildfly. I haven't found any specific method to do this, so my first approach would be setting it manually via an undertow filter: <filters> <response-...
8
votes
3answers
19k views

Adding HSTS to nginx config

I recently changed my nginx config to redirect all http traffic to https (and all www traffic to no-www). Would it make sense to also add add_header Strict-Transport-Security "max-age=31536000; ...
0
votes
3answers
569 views

Ideally, how should HSTS / SSL Everywhere / Let's encrypt work with captive Wifi portals?

Some captive Wifi portals require the ability to 301/302 redirect a user to an authentication / terms of service page before permitting access to the Internet. This is at odds with SSL, which can't ...
0
votes
2answers
317 views

HSTS secured domain migration

I bought a domain from a stranger and it seems like he protected the domain with HSTS-preloading. Is HSTS bound to the specific certificate which was used when HSTS was activated or can I just create ...
3
votes
3answers
3k views

How can I enable HSTS on the default Google Load Balancer coming with Google Container Engine?

I'd love to set up HSTS with my GKE cluster, as right now HTTP requests return a Google broken robot 404 page after setting this up in ingress.yml annotations: kubernetes.io/ingress.allow-http: "false"...
0
votes
1answer
293 views

Configure Apache to send HSTS header only in virtual hosts using HTTPS

We have an Apache 2.4 server that runs numerous virtual hosts, some of which use http and some of which use https. I would like to send the same HSTS (Strict-Transport-Security) header only in those ...
0
votes
1answer
508 views

If I'm using HSTS on nginx, does the website force redirecting to HTTP?

I need to access some images and JS files through HTTP, but if I enable HSTS with add_header Strict-Transport-Security "max-age=31536000";, all files are served forcibly through HTTPS. So I used ...
4
votes
1answer
2k views

Mikrotik - redirecting YouTube to a local friendly page

I'm configuring a rb750. I would like to drop YouTube access and redirect to a friendly page located in our local webserver. I can drop using l7 firewall but I'm not able to redirect user because ...
1
vote
2answers
1k views

hsts apache 2.4 not triggering?

I've set up Apache to use HSTS as follows just for testing and learning purposes only: /etc/apache2/sites-enabled/000-default.conf NameVirtualHost 192.168.3.55:80 NameVirtualHost 192.168.3.55:443 ...
1
vote
1answer
85 views

Why must a HSTS header not be sent on HTTP

Why must a HSTS header not be sent on HTTP? What would it hurt; clients could take it as a hint to redirect to https.
49
votes
9answers
13k views

Is there any reason not to enforce HTTPS on a website?

A website I frequent have finally decided to enable TLS to their servers, only not to mandate it as a lot of websites out there do. The maintainer claims that TLS must be optional. Why? On my own ...
0
votes
1answer
650 views

Point a subdomain to a separate IP address using DNS/nginx

I'm trying to point a subdomain to a different IP address on a different server, but for some reason it's only working every once in awhile (say 1 out of 20 times). Browsing to http//galera.domain.com ...
0
votes
1answer
459 views

how do i send website traffic to an http port if i have Strict-Transport-Security enforced?

how do i send website traffic to an http port if i have Strict-Transport-Security is enforced For example i have Strict-Transport-Security enforced if i embed a link that leads to http port 8000 the ...
13
votes
4answers
11k views

HSTS on Amazon CloudFront from S3 origin

Is it possible to set HSTS headers on an Amazon CloudFront distribution from a S3 origin?
0
votes
1answer
55 views

SSL on CloudFront fails test

I'm hosting a static website on S3/Cloudfront. I have enabled SSL using an Amazon provided SSL certificate. Unfortunately, the setup seems to be failing the SSL tests. Any idea what could cause this?...
5
votes
1answer
1k views

HSTS header not being sent though rule is present and mod_headers is enabled

We enabled HSTS in httpd.conf in the Virtual Host handling port 443. We tried with and without the <IfModule mod_headers.c>: <IfModule mod_headers.c> Header set Strict-Transport-...
1
vote
2answers
2k views

Disable HSTS and HPKP

We have a domain with HSTS and HPKP enabled and working. For a few reasons, we would like to disable it, not immediately, but as soon as key expires. This means that the site would remain accessible ...