How can a website stop browsers from falling back to insecure HTTP? An HTTP Strict Transport Security (HSTS) header tells browsers to use HTTPS for a specified period, helping prevent SSL-stripping and man-in-the-middle attacks. section 3.6 section 7.3
A one-week HSTS policy
Strict-Transport-Security: max-age=604800 tells a browser to remember the HTTPS-only rule for 604,800 seconds—one week. section 3.6
Use HSTS as part of a complete HTTPS configuration:
- Deploy a valid digital certificate and serve the application over HTTPS. section 3.11
- Redirect HTTP connections on port 80 to their HTTPS counterparts on port 443. section 7.3
- Send the HSTS header from the secure server so browsers can upgrade future requests without waiting for a redirect. section 7.3
server {
listen 80;
server_name example.com;
return 301 https://$server_name$request_uri; #1
}
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /path/to/ssl/certificate.crt; #2
ssl_certificate_key /path/to/ssl/private.key;
add_header Strict-Transport-Security
"max-age=31536000"; #3
ssl_protocols TLSv1.3; #4
}
An NGINX configuration combines the HTTP-to-HTTPS redirect, certificate settings, HSTS, and TLS 1.3. section 7.3
