NGINX Cookbook

There's more...

There's only a small point to remember: If you specify adding a header elsewhere (for example, a location block), you will need to redeclare the HSTS header. Consider the following example:

add_header Strict-Transport-Security "max-age=31536000;"; 
 
location  /api/ { 
    add_header 'Access-Control-Allow-Origin' '*'; 
    add_header 'Access-Control-Allow-Methods' 'GET, POST,      OPTIONS'; 
    add_header Strict-Transport-Security "max-age=31536000;"; 
} 

As we added access control headers, we needed to redeclare the HSTS header.