3 ms·
By the way. If you aren't well versed in web application security, don't just blindly follow guides likes this, especially when dealing with headers. You really
by ejcx 11y ago
By the way. If you aren't well versed in web application security, don't just blindly follow guides likes this, especially when dealing with headers. You really should learn about the technologies
> Strict-Transport-Security: max-age=63072000; includeSubdomains; always
I agree. All sites should be using HTTPS only and HSTS is a great thing, but if you blindly follow this guide you might break your subdomains that don't support HTTPS (third party or whatever crazy situation you have). The same thing goes for HPKP which tptacek suggested below.
There's a right way and a very wrong way to use HPKP and if you go mucking with these headers without fully understanding them yourself you might break your site for a ton of people.
- ams6110 11y agoCan you recommend a good reference for properly setting up HPKP?
- tombrossman 11y agoThis is a good guide: https://scotthelme.co.uk/hpkp-http-public-key-pinning/ https://scotthelme.co.uk/hpkp-http-public-key-pinning/ I had a difficult time getting it to work without throwing errors for either Nginx or SSL Labs tests and it was down to good old single vs. double-quotes. Copy-pasting the output from a policy generator is not at all guaranteed to work well. Here's a template you can use, substituting EXAMPLE for your certificate hashes (and optionally the report URI). Tested and working on Nginx and multiple third-party validators: add_header Public-Key-Pins 'pin-sha256="EXAMPLE"; pin-sha256="EXAMPLE"; max-age=86400; report-uri=" https://report-uri.io/report/EXAMPLE"'; https://report-uri.io/report/EXAMPLE"';