NGINX Cookbook

How to do it...

To enable the use of HSTS, we add an additional header to our server directive:

server { 
    listen              443 ssl http2; 
    server_name         http2.nginxcookbook.com; 
    ssl_certificate     /etc/ssl/public.pem; 
    ssl_certificate_key /etc/ssl/private.key; 
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2; 
    ssl_ciphers         HIGH:!aNULL:!MD5; 
 
    add_header Strict-Transport-Security "max-age=31536000; 
 
    access_log  /var/log/nginx/ssl-access.log  combined; 
 
    location  /favicon.ico { access_log off; log_not_found off; } 
    root  /var/www; 
} 

This header specifies the max-age, which in our case we have set to 31536000 seconds (which is 365 days). This means that the browser will cache the HSTS settings for an entire year and ensure that all requests for the next 365 days will be HTTPS only ...