302 Jump
Typically, we jump the user's HTTP request 302 to HTTPS, and there are two issues:
- Not secure enough, 302-hop transfer exposes users to the site and is easily hijacked
- Slow access speed, 302 jump requires a RTT (the role of packet loss and round-trip time), and the browser does jump takes a while
HSTS
302 jump is triggered by the browser, the server does not have full control, this demand led to the birth of HSTS (HTTP Strict Transport Security). HTSP is to add header header (Add_header strict-transport-security max-age=15768000;includesubdomains), tell the browser website to use HTTPS access, Browsers that support HSTS (Chrome, Firefox, ie all support HSTS (http://caniuse.com/#feat =stricttransportsecurity)) will switch directly to HTTPS in subsequent requests. In Chrome, you'll see an 307 Internal Redirect
internal redirect for your browser. Within a period of time defined by Max-age, regardless of whether the user enters www.ttlsa.com or http://www.ttlsa.com, the request is internally redirected to Https://www.ttlsa.com.
Server-side configuration hsts, reduce 302 jump, in fact hsts the biggest role is to prevent 302 HTTP hijacking. The disadvantage of HSTs is that the browser support rate is not high, and HTTPS is difficult to downgrade to HTTP in real time after configuring HSTs.
It is also recommended to enable Spdy to improve performance. For Spdy content See the previous article, not in addition to the description.
Here's how to enable HSTs in Apache2, NGINX, lighttpd.
Apache2
123456 |
# Optionally load the headers module:LoadModule headers_module modules/mod_headers. so<VirtualHost 0.0.0.0:443> Header always set Strict-Transport-Security "max-age=63072000; Includesubdomains; Preload " </VirtualHost> |
Then, restart the Apache service.
Nginx
1 |
Add_header Strict-Transport-Security "max-age=63072000; Includesubdomains; Preload "; |
Add the header to the server side and restart the service.
Lighttpd
1234 |
server. Modules + = ( "mod_setenv" ) $HTTP["scheme"] = = "https" { setenv. Add-response-header = ( "strict-transport-security" = > "max-age=63072000; Includesubdomains; Preload ") } |
X-frame-options Head
X-frame-options headers are added to the HTTPS site, ensuring that no Frame or IFRAME is embedded, avoiding click hijacking to ensure that the content of the site is not embedded in other sites.
Apache
1 |
Header always set X-Frame-Options DENY |
Nginx
1 |
Add_header X-Frame-options "DENY"; |
Lighttpd
1234 |
server. Modules + = ( "mod_setenv" ) $HTTP["scheme"] = = "https" { setenv. Add-response-header = ( "x-frame-options" => "DENY") } |
Nginx, Apache, lighttpd enable HSTs