Skip to content

Instantly share code, notes, and snippets.

@inetbiz

inetbiz/lighttpd-hsts.conf

Last active August 8, 2019 21:40
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save inetbiz/9712466 to your computer and use it in GitHub Desktop.
Save inetbiz/9712466 to your computer and use it in GitHub Desktop.
Download ZIP
Lighttpd HSTS Configuration
Raw
lighttpd-hsts.conf
server.modules += ( "mod_setenv" )
$HTTP["scheme"] == "https" {
setenv.add-response-header = ("Strict-Transport-Security" => "max-age=31536000; includeSubDomains; preload")
}
@ke352802081770314
Copy link

ke352802081770314 commented Apr 10, 2019 •
edited

https://hstspreload.org/ advises not to include preload in example configurations due to the difficulty to back out once a domain was included in the browsers' preload list. (Personally, I would also ask myself whether my domain is important enough to be rolled out to every browser in the world, or if my application is so security critical that this is appropriate. If I'm a bank, yes, sure, if I'm a blog, maybe not so much.)

Note that if you deploy mod_redirect e.g. to redirect from example.com to www.example.com, the list server.modules must contain mod_setenv BEFORE mod_redirect otherwise the header will not b e included in 301 responses, leaving example.com unprotected. (mentioned in https://redmine.lighttpd.net/issues/1895 and confirmed by my own tests with lighttpd 1.4.53) Line 1 would append mod_setenv to the end of the list.
Edit /etc/lighttpd/modules.conf (or other system-dependent location) and place 'mod_setenv' at the beginning of the server.modules list instead.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment