Nginx, Apache, lighttpd enable HSTs

Source: Internet
Author: User
Tags http strict transport security

http://www.ttlsa.com/web/hsts-for-nginx-apache-lighttpd/

302 Jump

Typically, we jump the user's HTTP request 302 to HTTPS, and there are two issues:
Not secure enough, 302-hop transfer exposes users to the site and is easily hijacked
Slow access speed, 302 jump requires a RTT (the role of packet loss and round-trip time), and the browser does jump takes a while

HSTS

302 jump is triggered by the browser, the server does not have full control, this demand led to the birth of HSTS (HTTP Strict Transport Security). HTSP is to add header header (Add_header strict-transport-security max-age=15768000;includesubdomains), tell the browser website to use HTTPS access, Browsers that support HSTS (Chrome, Firefox, ie all support HSTS (http://caniuse.com/#feat =stricttransportsecurity)) will switch directly to HTTPS in subsequent requests. You'll see in Chrome that your browser will have an internal redirect for 307 Internal Redirect. Within a period of time defined by Max-age, regardless of whether the user enters www.ttlsa.com or http://www.ttlsa.com, the request is internally redirected to Https://www.ttlsa.com.
Server-side configuration hsts, reduce 302 jump, in fact hsts the biggest role is to prevent 302 HTTP hijacking. The disadvantage of HSTs is that the browser support rate is not high, and HTTPS is difficult to downgrade to HTTP in real time after configuring HSTs.
It is also recommended to enable Spdy to improve performance. For Spdy content See the previous article, not in addition to the description.

Here's how to enable HSTs in Apache2, NGINX, lighttpd.

Apache2

# Optionally load the headers module:
LoadModule Headers_module modules/mod_headers.so

<virtualhost 0.0.0.0:443>
Header always set strict-transport-security "max-age=63072000; Includesubdomains; Preload "
</VirtualHost>

Then, restart the Apache service.

Nginx

Add_header strict-transport-security "max-age=63072000; Includesubdomains; Preload ";

Add the header to the server side and restart the service.

Lighttpd

Server.modules + = ("mod_setenv")
$HTTP ["scheme"] = = "https" {
Setenv.add-response-header = ("strict-transport-security" = "max-age=63072000"; Includesubdomains; Preload ")
}


x-frame-options Head

X-frame-options headers are added to the HTTPS site, ensuring that no Frame or IFRAME is embedded, avoiding click hijacking to ensure that the content of the site is not embedded in other sites.

Apache

Header always set x-frame-options DENY

Nginx

Add_header x-frame-options "DENY";

Lighttpd

Server.modules + = ("mod_setenv")
$HTTP ["scheme"] = = "https" {
Setenv.add-response-header = ("x-frame-options" = "DENY")
}

Nginx, Apache, lighttpd enable HSTs

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.