HSTS header in Nginx - Commands & Configuration

Introduction

Websites need to keep visitors safe by making sure browsers only use secure connections. The HSTS header tells browsers to always use HTTPS, preventing unsafe connections.

When you want to make sure visitors never connect to your site using HTTP by mistake.

When you want to protect users from attackers trying to intercept their data by forcing secure connections.

When you have recently switched your website to HTTPS and want browsers to remember this.

When you want to improve your website's security score and trustworthiness.

When you want to avoid mixed content warnings caused by loading some parts over HTTP.

Config File - nginx.conf

nginx.conf

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate /etc/ssl/certs/example.com.crt;
    ssl_certificate_key /etc/ssl/private/example.com.key;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    location / {
        root /var/www/html;
        index index.html;
    }
}

This configuration sets up an HTTPS server on port 443 for example.com.

The add_header Strict-Transport-Security line adds the HSTS header to tell browsers to only use HTTPS for the next year (31536000 seconds) and also apply this rule to all subdomains.

The always flag ensures the header is sent even on error responses.

Commands

Check the nginx configuration file for syntax errors before applying changes.

Terminal

sudo nginx -t

Expected Output

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok

nginx: configuration file /etc/nginx/nginx.conf test is successful

Reload nginx to apply the new configuration without stopping the server.

Terminal

sudo systemctl reload nginx

Expected Output

No output (command runs silently)

Request the headers from the website to verify the HSTS header is present.

Terminal

curl -I https://example.com

Expected Output

HTTP/2 200 

server: nginx

strict-transport-security: max-age=31536000; includeSubDomains

content-type: text/html

→

-I - Fetch only the HTTP headers without the body

Key Concept

If you remember nothing else from this pattern, remember: the HSTS header forces browsers to always use secure HTTPS connections to your site.

Common Mistakes

Adding the HSTS header only on HTTPS but not using the 'always' flag.

The header might not be sent on error pages, leaving some responses unprotected.

Use 'add_header Strict-Transport-Security ... always;' to ensure the header is sent on all responses.

Setting a very short max-age value like 0 or a few seconds.

Browsers won't remember the HTTPS-only rule long enough to protect users effectively.

Set max-age to at least 31536000 seconds (1 year) for strong protection.

Adding the HSTS header on HTTP (port 80) server blocks.

Browsers ignore HSTS headers on insecure HTTP connections; it must be sent only over HTTPS.

Add the HSTS header only in the HTTPS server block.

Summary

Add the HSTS header in the nginx HTTPS server block using 'add_header Strict-Transport-Security'.

Test the nginx configuration with 'nginx -t' before reloading to avoid errors.

Verify the header is sent by requesting headers with 'curl -I https://example.com'.

Practice

1. What is the main purpose of the Strict-Transport-Security (HSTS) header in nginx?

easy

A. To force browsers to use HTTPS instead of HTTP for the site

B. To redirect HTTP requests to a different domain

C. To enable caching of static files in the browser

D. To compress responses sent to the client

Solution

1. Step 1: Understand HSTS header purpose

   The HSTS header tells browsers to only use HTTPS for the site, improving security.

2. Step 2: Compare options with HSTS function

   Only To force browsers to use HTTPS instead of HTTP for the site matches this purpose; others describe unrelated features.

3. Final Answer:

   To force browsers to use HTTPS instead of HTTP for the site -> Option A

4. Quick Check:

   HSTS = Force HTTPS [OK]

Hint: HSTS means browsers must use HTTPS always [OK]

Common Mistakes:

• Confusing HSTS with redirects
• Thinking HSTS controls caching
• Assuming HSTS compresses data

2. Which of the following is the correct nginx syntax to add an HSTS header that lasts for 1 year and applies to all subdomains?

easy

A. add_header Strict-Transport-Security max-age=31536000 includeSubDomains always;

B. add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

C. add_header Strict-Transport-Security "max-age=31536000 includeSubDomains";

D. add_header Strict-Transport-Security max-age=31536000; includeSubDomains always;

Solution

1. Step 1: Check correct syntax for add_header

   The header value must be a quoted string with directives separated by semicolons, and 'always;' ensures it is added on all responses.

2. Step 2: Validate option formatting

   add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; correctly quotes the value and uses semicolon between directives with 'always;'. Others miss quotes or semicolons or misplace 'always'.

3. Final Answer:

   add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; -> Option B

4. Quick Check:

   Quotes + semicolon + always = add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; [OK]

Hint: Use quotes and semicolons inside add_header value [OK]

Common Mistakes:

• Missing quotes around header value
• Forgetting semicolon between directives
• Placing 'always' inside quotes

3. Given this nginx config snippet:

add_header Strict-Transport-Security "max-age=86400; includeSubDomains" always;

What is the effect on browsers visiting the site?

medium

A. Browsers will enforce HTTPS for 1 day on the site and all subdomains

B. Browsers will enforce HTTPS for 1 year on the site only

C. Browsers will ignore the header because max-age is too low

D. Browsers will enforce HTTPS for 1 day on the site only

Solution

1. Step 1: Interpret max-age and includeSubDomains

   max-age=86400 means 86400 seconds = 1 day. includeSubDomains applies to all subdomains.

2. Step 2: Understand browser behavior

   Browsers will enforce HTTPS for 1 day on the site and all its subdomains as per header.

3. Final Answer:

   Browsers will enforce HTTPS for 1 day on the site and all subdomains -> Option A

4. Quick Check:

   86400 seconds = 1 day + includeSubDomains = Browsers will enforce HTTPS for 1 day on the site and all subdomains [OK]

Hint: max-age in seconds; 86400 = 1 day [OK]

Common Mistakes:

• Confusing seconds with days
• Ignoring includeSubDomains effect
• Assuming max-age too low disables HSTS

4. You added this line in nginx:

add_header Strict-Transport-Security max-age=31536000 includeSubDomains always;

Why is the HSTS header not sent to clients?

medium

A. includeSubDomains is not a valid directive

B. The 'always' directive must be inside the quotes

C. max-age value is too large and rejected by nginx

D. The header value is missing quotes, causing syntax error

Solution

1. Step 1: Check syntax for add_header directive

   The header value must be enclosed in quotes. Missing quotes cause nginx to ignore the header.

2. Step 2: Validate other parts

   'always' must be outside quotes, max-age=31536000 is valid, includeSubDomains is valid directive.

3. Final Answer:

   The header value is missing quotes, causing syntax error -> Option D

4. Quick Check:

   Quotes missing = header not sent [OK]

Hint: Always quote header values in add_header [OK]

Common Mistakes:

• Placing 'always' inside quotes
• Not quoting header value
• Misunderstanding valid directives

5. You want to preload your site in browsers' HSTS preload list. Which nginx header configuration is correct to achieve this for 6 months including subdomains?

hard

A. add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

B. add_header Strict-Transport-Security "max-age=15768000; preload" always;

C. add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;

D. add_header Strict-Transport-Security "max-age=15768000; includeSubDomains" always;

Solution

1. Step 1: Calculate max-age for 6 months

   6 months ≈ 15768000 seconds (6 * 30 * 24 * 3600).

2. Step 2: Include required directives for preload

   Preload requires max-age, includeSubDomains, and preload directive all present.

3. Step 3: Verify syntax correctness

   add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always; correctly quotes the value, uses semicolons, includes all directives, and uses 'always;'.

4. Final Answer:

   add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always; -> Option C

5. Quick Check:

   Preload + includeSubDomains + 6 months = add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always; [OK]

Hint: Preload needs max-age, includeSubDomains, preload keywords [OK]

Common Mistakes:

• Using wrong max-age for 6 months
• Omitting preload directive
• Not quoting header value