HSTS header in Nginx - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does HSTS stand for and what is its main purpose?

HSTS stands for HTTP Strict Transport Security. Its main purpose is to tell browsers to only connect to a website using HTTPS, improving security by preventing insecure HTTP connections.

beginner

How do you enable HSTS in an nginx server configuration?

You add the header Strict-Transport-Security in the server block for HTTPS, for example:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

beginner

What does the max-age directive in the HSTS header control?

The max-age directive sets how long (in seconds) the browser should remember to only use HTTPS for the site. For example, max-age=31536000 means 1 year.

intermediate

What is the effect of adding includeSubDomains in the HSTS header?

Adding includeSubDomains tells browsers to apply the HSTS policy to all subdomains of the site, not just the main domain.

intermediate

Why should the HSTS header be sent only over HTTPS connections?

Because HSTS tells browsers to only use HTTPS, sending it over HTTP would be insecure and could allow attackers to intercept or strip the header.

What is the correct nginx directive to add the HSTS header?

A add_header HSTS "max-age=31536000; includeSubDomains";

B set_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

C header_add Strict-Transport-Security "max-age=31536000; includeSubDomains";

D add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

The correct nginx directive is add_header with the full header name Strict-Transport-Security and the value including max-age and optionally includeSubDomains. The always flag ensures it is added on all responses.

What does the max-age value in the HSTS header represent?

A The number of subdomains to include

B The number of seconds the browser should enforce HTTPS only

C The number of requests allowed over HTTP

D The timeout for HTTPS connections

max-age sets the time in seconds that the browser remembers to only use HTTPS for the site.

Why is it important to include includeSubDomains in the HSTS header?

A To apply HSTS policy to all subdomains as well

B To exclude subdomains from HSTS

C To enable HTTP connections on subdomains

D To disable HTTPS on subdomains

Including includeSubDomains tells browsers to enforce HTTPS on all subdomains, improving overall security.

What happens if you send the HSTS header over an HTTP connection?

A It can be intercepted or stripped by attackers

B It forces the browser to use HTTPS immediately

C It disables HTTPS for the site

D It has no effect

Sending HSTS over HTTP is insecure because attackers can intercept or remove the header, defeating its purpose.

Which of these is a valid HSTS header value?

A "max-age=31536000; excludeSubDomains"

B "max-age=one year; includeSubDomains"

C "max-age=31536000; includeSubDomains"

D "max-age=0; includeSubDomains"

The value must use seconds for max-age and can include includeSubDomains. "one year" is invalid, and excludeSubDomains is not a valid directive.

Explain how to configure the HSTS header in nginx and why it is important.

Think about telling browsers to always use HTTPS and how nginx sends headers.

Describe the risks of not using HSTS on a website that supports HTTPS.

Consider what happens if browsers are allowed to connect over HTTP.

Practice

1. What is the main purpose of the Strict-Transport-Security (HSTS) header in nginx?

easy

A. To force browsers to use HTTPS instead of HTTP for the site

B. To redirect HTTP requests to a different domain

C. To enable caching of static files in the browser

D. To compress responses sent to the client

Solution

1. Step 1: Understand HSTS header purpose

   The HSTS header tells browsers to only use HTTPS for the site, improving security.

2. Step 2: Compare options with HSTS function

   Only To force browsers to use HTTPS instead of HTTP for the site matches this purpose; others describe unrelated features.

3. Final Answer:

   To force browsers to use HTTPS instead of HTTP for the site -> Option A

4. Quick Check:

   HSTS = Force HTTPS [OK]

Hint: HSTS means browsers must use HTTPS always [OK]

Common Mistakes:

• Confusing HSTS with redirects
• Thinking HSTS controls caching
• Assuming HSTS compresses data

2. Which of the following is the correct nginx syntax to add an HSTS header that lasts for 1 year and applies to all subdomains?

easy

A. add_header Strict-Transport-Security max-age=31536000 includeSubDomains always;

B. add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

C. add_header Strict-Transport-Security "max-age=31536000 includeSubDomains";

D. add_header Strict-Transport-Security max-age=31536000; includeSubDomains always;

Solution

1. Step 1: Check correct syntax for add_header

   The header value must be a quoted string with directives separated by semicolons, and 'always;' ensures it is added on all responses.

2. Step 2: Validate option formatting

   add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; correctly quotes the value and uses semicolon between directives with 'always;'. Others miss quotes or semicolons or misplace 'always'.

3. Final Answer:

   add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; -> Option B

4. Quick Check:

   Quotes + semicolon + always = add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; [OK]

Hint: Use quotes and semicolons inside add_header value [OK]

Common Mistakes:

• Missing quotes around header value
• Forgetting semicolon between directives
• Placing 'always' inside quotes

3. Given this nginx config snippet:

add_header Strict-Transport-Security "max-age=86400; includeSubDomains" always;

What is the effect on browsers visiting the site?

medium

A. Browsers will enforce HTTPS for 1 day on the site and all subdomains

B. Browsers will enforce HTTPS for 1 year on the site only

C. Browsers will ignore the header because max-age is too low

D. Browsers will enforce HTTPS for 1 day on the site only

Solution

1. Step 1: Interpret max-age and includeSubDomains

   max-age=86400 means 86400 seconds = 1 day. includeSubDomains applies to all subdomains.

2. Step 2: Understand browser behavior

   Browsers will enforce HTTPS for 1 day on the site and all its subdomains as per header.

3. Final Answer:

   Browsers will enforce HTTPS for 1 day on the site and all subdomains -> Option A

4. Quick Check:

   86400 seconds = 1 day + includeSubDomains = Browsers will enforce HTTPS for 1 day on the site and all subdomains [OK]

Hint: max-age in seconds; 86400 = 1 day [OK]

Common Mistakes:

• Confusing seconds with days
• Ignoring includeSubDomains effect
• Assuming max-age too low disables HSTS

4. You added this line in nginx:

add_header Strict-Transport-Security max-age=31536000 includeSubDomains always;

Why is the HSTS header not sent to clients?

medium

A. includeSubDomains is not a valid directive

B. The 'always' directive must be inside the quotes

C. max-age value is too large and rejected by nginx

D. The header value is missing quotes, causing syntax error

Solution

1. Step 1: Check syntax for add_header directive

   The header value must be enclosed in quotes. Missing quotes cause nginx to ignore the header.

2. Step 2: Validate other parts

   'always' must be outside quotes, max-age=31536000 is valid, includeSubDomains is valid directive.

3. Final Answer:

   The header value is missing quotes, causing syntax error -> Option D

4. Quick Check:

   Quotes missing = header not sent [OK]

Hint: Always quote header values in add_header [OK]

Common Mistakes:

• Placing 'always' inside quotes
• Not quoting header value
• Misunderstanding valid directives

5. You want to preload your site in browsers' HSTS preload list. Which nginx header configuration is correct to achieve this for 6 months including subdomains?

hard

A. add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

B. add_header Strict-Transport-Security "max-age=15768000; preload" always;

C. add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;

D. add_header Strict-Transport-Security "max-age=15768000; includeSubDomains" always;

Solution

1. Step 1: Calculate max-age for 6 months

   6 months ≈ 15768000 seconds (6 * 30 * 24 * 3600).

2. Step 2: Include required directives for preload

   Preload requires max-age, includeSubDomains, and preload directive all present.

3. Step 3: Verify syntax correctness

   add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always; correctly quotes the value, uses semicolons, includes all directives, and uses 'always;'.

4. Final Answer:

   add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always; -> Option C

5. Quick Check:

   Preload + includeSubDomains + 6 months = add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always; [OK]

Hint: Preload needs max-age, includeSubDomains, preload keywords [OK]

Common Mistakes:

• Using wrong max-age for 6 months
• Omitting preload directive
• Not quoting header value