Warning `"Strict-Transport-Security" HTTP header is not set`

chadgeary / cloudoffice

Cloudoffice deploys Nextcloud and OnlyOffice automatically with LetsEncrypt HTTPS certificates. Text and video instructions included. Six compatible cloud providers, or via Ubuntu/Raspberry Pi. Cloud provider deployments include low-cost object storage integration (e.g. S3).

Apache License 2.0

101 stars 12 forks source link

Warning `"Strict-Transport-Security" HTTP header is not set` #4

Closed JCZuurmond closed 3 years ago

JCZuurmond commented 3 years ago

In the adminstartion overview I see the following warning The "Strict-Transport-Security" HTTP header is not set to at least "15552000" seconds. For enhanced security, it is recommended to enable HSTS as described in the security tips ↗.. It links to this doc page. How do we set the "Strict-Transport-Security" HTTP header?

chadgeary commented 3 years ago

It can be done via the nginx container (web proxy) for duckdns - see the nginx confirms under playbooks/