After upgrading to 1.9.0.beta3 , the SSL(Let’s Encrypt) rating has changed from A+ to A，the problem is HSTS.
Thanks very much
AI-generated summary
Let’s Encrypt problem after upgrading to 1.9.0.beta3
After upgrading to 1.9.0.beta3, saluzi noticed their SSL rating dropped from A+ to A due to an issue with HTTP Strict Transport Security (HSTS). mpalmer investigated and found that saluzi’s site was not sending an HSTS header at all.
codinghorror initially reported that HSTS was working fine on their self-hosted Discourse install. However, mpalmer later discovered that codinghorror’s site was also not sending an HSTS header.
Falco admitted to making a mistake when adding the Referrer-Policy header, which caused the issue. Falco provided a fix, and codinghorror confirmed that HSTS is now working correctly again.
1 „Gefällt mir“
What is the problem with HSTS?
Using the ssllabs.com query, HTTP Strict Transport Security (HSTS) with long duration deployed on this server this sentence disappears . Thank you.
The default HSTS configuration is compliant with the SSL Labs recommendations. What site are you testing, and what changes have you made to the default discourse_docker templates?
I have nothing to change, completely default. My website is https://www.xxxx.com/
Your site is not sending an HSTS header at all. You’re also sending a header that was reverted from the default template nine days ago. Whatever you’re doing over there, it isn’t what we recommend.
4 „Gefällt mir“
Hmm, plausible, as I did a command line rebuild yesterday cc @falco.
1 „Gefällt mir“
Can confirm discourse.codinghorror.com is no longer sending a HSTS header at all:
$ wget -O /dev/null -S https://discourse.codinghorror.com -q
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 13 Jul 2017 22:04:15 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Discourse-Route: list/latest
Cache-Control: no-store, must-revalidate, no-cache, private
X-Discourse-Cached: true
X-Request-Id: f40d4ea9-375a-4a9e-b6e1-c7500ffa194f
X-Runtime: 0.002585
X-Discourse-TrackView: 1
Referrer-Policy: no-referrer-when-downgrade
2 „Gefällt mir“
Yeah, I made a mistake when I added the Referrer-Policy header.
nginx add_header lack of support for inheritance got me there.
Will fix soon.
9 „Gefällt mir“
Awwwwwwww yeah… we’ve all been to that circle of hell.
6 „Gefällt mir“
Rebuild a site to test this in action:
https://github.com/discourse/discourse_docker/commit/42504d319c1c7abe8501e8db4efcf1707aaaa240
6 „Gefällt mir“
8 „Gefällt mir“