Nginx, Apache, lighttpd enable HSTs

302 Jump

Typically, we jump the user's HTTP request 302 to HTTPS, and there are two issues:

1. Not secure enough, 302-hop transfer exposes users to the site and is easily hijacked
2. Slow access speed, 302 jump requires a RTT (the role of packet loss and round-trip time), and the browser does jump takes a while

HSTS

302 jump is triggered by the browser, the server does not have full control, this demand led to the birth of HSTS (HTTP Strict Transport Security). HTSP is to add header header (Add_header strict-transport-security max-age=15768000;includesubdomains), tell the browser website to use HTTPS access, Browsers that support HSTS (Chrome, Firefox, ie all support HSTS (http://caniuse.com/#feat =stricttransportsecurity)) will switch directly to HTTPS in subsequent requests. In Chrome, you'll see an 307 Internal Redirect internal redirect for your browser. Within a period of time defined by Max-age, regardless of whether the user enters www.ttlsa.com or http://www.ttlsa.com, the request is internally redirected to Https://www.ttlsa.com.

Server-side configuration hsts, reduce 302 jump, in fact hsts the biggest role is to prevent 302 HTTP hijacking. The disadvantage of HSTs is that the browser support rate is not high, and HTTPS is difficult to downgrade to HTTP in real time after configuring HSTs.

It is also recommended to enable Spdy to improve performance. For Spdy content See the previous article, not in addition to the description.

Here's how to enable HSTs in Apache2, NGINX, lighttpd.

Apache2

123456

# Optionally load the headers module:LoadModule headers_module modules/mod_headers. so<VirtualHost 0.0.0.0:443> Header always set Strict-Transport-Security "max-age=63072000; Includesubdomains; Preload " </VirtualHost>

Then, restart the Apache service.

Nginx

1	Add_header Strict-Transport-Security "max-age=63072000; Includesubdomains; Preload ";

Add the header to the server side and restart the service.

Lighttpd

1234	server. Modules + = ( "mod_setenv" ) $HTTP["scheme"] = = "https" { setenv. Add-response-header = ( "strict-transport-security" = > "max-age=63072000; Includesubdomains; Preload ") }

X-frame-options Head

X-frame-options headers are added to the HTTPS site, ensuring that no Frame or IFRAME is embedded, avoiding click hijacking to ensure that the content of the site is not embedded in other sites.

Apache

1	Header always set X-Frame-Options DENY

Nginx

1	Add_header X-Frame-options "DENY";

Lighttpd

1234	server. Modules + = ( "mod_setenv" ) $HTTP["scheme"] = = "https" { setenv. Add-response-header = ( "x-frame-options" => "DENY") }

Nginx, Apache, lighttpd enable HSTs