HSTS header in Nginx - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

What is the effect of this nginx HSTS header configuration?

Given this nginx configuration snippet, what will be the exact HTTP response header sent to clients?

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

A Strict-Transport-Security: max-age=0

B Strict-Transport-Security: max-age=31536000

C Strict-Transport-Security: max-age=31536000; includeSubDomains

D Strict-Transport-Security: max-age=31536000; preload

💡 Hint

Look carefully at the exact string inside the quotes in the add_header directive.

The add_header directive sets the Strict-Transport-Security header with max-age=31536000 and includeSubDomains as specified. The 'always' flag ensures it is sent on all responses.

❓ Configuration

intermediate

Which nginx config disables HSTS completely?

You want to disable HSTS on your nginx server. Which configuration line will remove the Strict-Transport-Security header from responses?

A add_header Strict-Transport-Security "max-age=0" always;

B add_header Strict-Transport-Security "" always;

C add_header Strict-Transport-Security "max-age=31536000" always;

D remove_header Strict-Transport-Security;

💡 Hint

Setting max-age to zero tells browsers to stop enforcing HSTS.

Setting max-age=0 instructs browsers to remove the HSTS policy. The other options either set an empty header or are invalid directives.

❓ Troubleshoot

advanced

Why is HSTS header missing despite nginx config?

You configured nginx with:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

But the header is missing in HTTP responses. What is the most likely cause?

A The server firewall blocks the Strict-Transport-Security header.

B The add_header directive syntax is incorrect and causes nginx to ignore it.

C The browser is caching old responses without the header.

D The site is accessed over HTTP, not HTTPS, so HSTS header is not sent.

💡 Hint

HSTS only applies to secure HTTPS connections.

HSTS headers are only sent on HTTPS responses. If the site is accessed via HTTP, nginx does not send this header.

✅ Best Practice

advanced

What is the recommended minimum max-age value for HSTS in production?

For strong security, what is the recommended minimum max-age value (in seconds) to set in the Strict-Transport-Security header?

A 86400 (1 day)

B 31536000 (1 year)

C 2592000 (30 days)

D 0 (disable HSTS)

💡 Hint

Longer max-age values enforce HSTS for longer periods.

Security best practice recommends at least 1 year (31536000 seconds) to ensure browsers remember to only use HTTPS.

🧠 Conceptual

expert

What risk does missing 'includeSubDomains' in HSTS header pose?

If your nginx HSTS header is:

Strict-Transport-Security: max-age=31536000

but does NOT include 'includeSubDomains', what is the main security risk?

A Subdomains can still be accessed over HTTP, allowing man-in-the-middle attacks.

B Browsers will ignore the HSTS header completely.

C The max-age value will be treated as zero by browsers.

D The server will reject HTTPS connections on subdomains.

💡 Hint

Consider how HSTS applies to subdomains when 'includeSubDomains' is missing.

Without 'includeSubDomains', subdomains are not forced to use HTTPS, which can allow attackers to intercept traffic on those subdomains.