Strict-Transport-Security 헤더에 includeSubDomains 추가 방법

지원 자체 호스팅
1

클라이언트가 유용한 보안 스캐너를 사용했고, 이제 Strict-Transport-Security 헤더에 ‘includeSubdomains’가 포함되어야 한다고 생각합니다.

app.yml에 다음 두 가지를 모두 추가했습니다:


  after_ssl:
    - replace:
        filename: /etc/nginx/conf.d/outlets/server/20-https.conf
        from: "max-age=31536000;"
        to:  "max-age=31536000; includeSubDomains;"
    - replace:
        filename: /etc/nginx/conf.d/outlets/discourse/20-https.conf
        from: "max-age=31536000;"
        to:  "max-age=31536000; includeSubDomains;"

- exec: sed -i "s/add_header Strict-Transport-Security 'max-age=31536000';/add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;/" /etc/nginx/conf.d/outlets/discourse/20-https.conf /etc/nginx/conf.d/outlets/server/20-https.conf

둘 다 작동하지 않습니다. 두 번째 코드 블록의 sed 명령을 컨테이너 안에서 직접 실행하면 nginx를 재시작한 후 요청한 대로 동작합니다.

왜 작동하지 않는지 이해가 되지 않습니다.

또한, 이 설정은 원래 템플릿에 있었지만 2014년에 제거된 것 같습니다. 하지만 최근 게시물 중 일부에는 includeSubdomains가 포함된 헤더가 표시되고 있습니다.

아무런 실마리도 없습니다.

2

Hmm.. you don’t seem to be getting an answer here. Does this topic belong in Development or #installation:hosting? :thinking:

3

Well,l I moved it there, but the initial issue is that someone claimed that not setting includeSubDomains was a security issue.

I’d love it if someone who knew and cared about whether having IncludeSubDomains in the the STS header was important could address the issue so perhaps I could tell this person that hundreds of thousands of other sites disagree and that perhaps the script that someone ran to find these “security flaws” is wrong.

So maybe I should rename this “missing includeSubDomains in STS header considered harmful”

5

I would call it a configuration choice instead.

Is the forum on an apex domain or not?

I always tell people that we are very cautious of setting headers that affect other hostnames on their domain, and if they want to have HSTS on those, they should set the headers on those respective hosts instead.

The only valid reason I can think of is they cannot do that, e.g. when the forum is on an apex domain and the client is not able to control the HSTS headers on other externally hosted hosts, e.g. they have hostedshopify.example.com as well. Then they basically come to you because you’re the path of least resistance :slight_smile:

6

It is not.

That’s what I think I thought, though I wasn’t able to articulate it.

Thanks. I’ll tell them that since it’s not the Apex domain it’s Best Practice to have each host enforce its own rules.

Thanks so very much. This is a big help. At least now am pretty sure thatI understand.