Enterprise Cloud Security and Governance

Implementing HSTS in nginx

HSTS support is communicated to the web browsers by sending the following response header:

Strict-Transport-Security: max-age=30000000

This is generally used in conjunction with the includeSubDomains directive, which tells a browser that it applies to all the subdomains for that domain:

Strict-Transport-Security: max-age=30000000; includeSubDomainsInside the server { block, just add the following line :-add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

The new configuration looks something like the one shown in the following screenshot:

Restart the nginx server and grade your configuration ...