====== Ubuntu - NginX - HTTPS Strict Transport Security (HSTS) ======

The HTTP Strict Transport Security (HSTS) header allows a host to enforce the use of HTTPS on the client side.

By informing the browser to only use HTTPS, even if the user specifies HTTP as the protocol, the browser will enforce the use of HTTPS.  This protects the user from various forms of SSL stripping attacks and provides the host an option to better enforce the use of secure communications. 

HSTS, coupled with server side redirection from HTTP to HTTPS, offers a more robust implementation of SSL as the browser is now aware that you expect secure comms.  If a Man In the Middle tries to strip out SSL from your communications by acting as a proxy, your browser will refuse the connection because it is expecting HTTPS and not HTTP.

----

===== NginX - Setting up HSTS in NginX =====

To be fully HSTS compliant a host should only issue a HSTS header over a secure transport layer. This is because an attacker can maliciously strip out or inject a HSTS header into insecure traffic. For that reason, a browser should also disregard any HSTS headers received via HTTP, so technically it shouldn't matter if you do issue it over HTTP.

<code nginx>
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
</code>

...and as it would be within a config file...

<code nginx>
server {
  listen 443 ssl;
  server_name sharewiz.net;
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
  ...
}  
</code>

The **'max-age'** values specifies how long, in seconds, you want the client to treat you as a HSTS host.  That is, how long you want them to contact you using HTTPS exclusively.  The value 31536000 is 1 year and each time the client visits the site and receives the header, the timer is reset back to a year.  Assuming your browser is HSTS compliant, after the first page loads over HTTPS, you will no longer be able to communicate with this site via HTTP, the browser will prevent it.  

The optional **'includeSubDomains'** directive enforces the HSTS policy against all sub-domains.

The optional **always** parameter ensures that the header is set for all responses, including internally-generated error responses.  Older versions of NGINX (prior to 1.7.5 or NGINX Plus R5) don’t support the always parameter and do not set the header on internally-generated error responses.

----

===== Restart NginX =====

<code bash>sudo systemctl restart nginx.service</code>