HSTS on canonical domain only

smockensturm

posted 3 years ago

Security

Last updated 2 years ago.

tomhatzer

replied 3 years ago

Solution

Hey!

You can update your nginx configuration like described in this Laracasts episode: https://laracasts.com/series/learn-laravel-forge/episodes/22

With the config open, add this line to the server block for your canonical domain:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

so it will look something like this:

server {
    listen 443 ssl;
    ...
    server_name <your-canonical-domain>;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    ...
}

You can change the max-age value to your preferred value.

Solution selected by @driesvints

smockensturm

replied 3 years ago

Hey! Thanks!

But that also forces the WWW to be secure, yes? We do not want that. Does that make sense?

tomhatzer

replied 3 years ago

Ah, yeah. You can remove the includeSubDomains and only leave the max-age like this:

add_header Strict-Transport-Security "max-age=31536000" always;

The mozilla docs show this as valid option.

Last updated 3 years ago.

smockensturm

replied 3 years ago

Great. Thanks a bunch!

Moderators