ydns / bash-updater

YDNS Bash Updater Script
GNU General Public License v3.0
80 stars 43 forks source link

HTTP Strict-Transport-Security #36

Open Mikaela opened 9 years ago

Mikaela commented 9 years ago

Currently it looks like http://ydns.eu/ does server-side redirect to https://ydns.eu/. It would be more secure if there was also HSTS so clients wouldn't even attempt to connect using http within the specified time.

I think the nginx server block would need add_header Strict-Transport-Security max-age=15552000; (for half-year).

I personally use add_header Strict-Transport-Security "max-age=15552000; includeSubdomains; preload";, but includeSubdomains wouldn't work here as it would require all users who run httpd to have HTTPS with valid certificate and preload requires subdomains to be included or the preload list doesn't accept your submission.