Closed steverowling closed 4 years ago
So interestingly...
The always parameter ensures that the header is set for all responses, including internally generated error responses. Older versions of NGINX (prior to version 1.7.5 or NGINX Plus R5) don’t support the always parameter and do not set the header on internally generated error responses.
But given that 1.7.5 was released in September, 2014, I'll assume it's safe to include
I was wondering if the other security headers should be always
too -- looks so -> https://www.attosol.com/http-security-headers-with-nginx/
Headers in the
security.conf
partial should have thealways
parameter added to ensure that they are added regardless of the response code, see here: https://nginx.org/en/docs/http/ngx_http_headers_module.htmlThis came up recently on a site that I had penetration tested. I originally had missed off the
always
parameter and the pen tester reported it as a potential vulnerability as the HSTS headers weren't sent with error responses. Adding thealways
parameter as shown below resolved the issue.add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;