hstspreload.org | : lock : Chromium 's HSTS preload list submission website | Browser Plugin library

As said Lars Stegelitz, I have to run these services on different ports. I did that and now Nextcloud runs on 445 port, at the same time Seafile on 443. I've added location /nextcloud and there is directive proxy_pass https://192.168.1.134:445; Here are my updated configs. seafile.conf:

The issue is your are sending the header when the user is connected using HTTP

If you want to force them to use HTTPS, perform a redirect first like this.

You haven't given enough information as to your set up, but I can take a guess at what is going on.

I would guess you you are offloading your SSL at your ELB and sending plaintext HTTP messages to Nginx with the HTTP_X_FORWARDED_PROTO header set to the original scheme.

So if the user goes to https://www.example.com then it offloads the SSL/TLS and directs traffic to http://www.example.com with the HTTP_X_FORWARDED_PROTO set to "https". In this scenario there is no redirect (as user is already using HTTPS) but also no HSTS header (as user is not using HTTPS to nginx and you only set that header in your 443 server config). You should add this to your port 80 server to also serve the HSTS header for this scenario:

If you go direct in one step:

This works for me:

I don’t think it’s overkill to add it to every resource. It’s a very small header and ensures the best change of the HSTS policy being seen.

Many people even load a pixel from the base domain (e.g. www.example.com can load https://example.com/1pixel.png) to ensure the base domain HSTS policy is loaded as well. If you configure HSTS to only be delivered on documents then this is not picked up.

I certain would not include it only on the home page. That’s not a valid assumption to say that sooner or later they visit it.

What’s your concern here? You have a super optimised site that will be killed by serving this header with each resource? For CSP I’d understand where you were coming from as that header can get very large but for HSTS I really think you’re over thinking this. Also if using HTTP/2 then header compression solves this too. Plus the config needed to only return it on some resources would be added complexity and hassle you don’t really need.

Summary of the comments:

• Configuration in httpd.conf and .htaccess is read top to bottom.
• For RewritRules, they are applied in sequence, top to bottom, until you reach the last one. All rules that match the condition are applied.
• To prevent that, you can add the [L] tag to a RewriteRule. This tag says to Apache that it was the last rule to apply if it matches the conditions. All further rules are ignored for this request.

The sequence of rewrites here is:

1. the client requests http://example.com
2. A RewriteRule redirects the client to https://example.com
3. The client comes back with https://example.com
4. A second RewriteRule redirects the client to https://www.example.com
5. The client comes back with https://www.example.com
6. No Rewriterule applies, Apache responds to the request.

Why do it this way? It covers all cases. If a client's first request is already https://example.com, the scenario above will start at step 4.

A sample configuration could look like:

I am really thankful you posted this, because I have exactly the same issue, i.e., http://DOMAIN redirects directly to https://www.DOMAIN, combining the redirect to HTTPS and the one to the www subdomain.

I know it would have been the "easy" solution.

Note that there are reasons to use a subdomain like www, as has been discussed on several occasions already, and so this choice is completely understandable.

However, HSTS has no way (at least not yet) to combine the two redirects: It can only forward directly to HTTPS. I suppose that if the HSTS preload site detects that this is not what the plain HTTP server itself does, then enforcing a "307 internal redirect" to just HTTPS is not admissible. (As far as I can tell, this requirement is not explicitly stated on hstspreload.org, but can only be found out by actually trying to set up the HSTS preload.)

I have no full answer to your question, but I can provide a bit more information on a few points you raise:

If you are serving a redirect, that redirect must have the HSTS header, not the page it redirects to.

Please note the exact (current) quote from hstspreload.org:

If you are serving an additional redirect from your HTTPS site, that redirect must still have the HSTS header (rather than the page it redirects to).

This is relevant for the following point:

As far as I know there is no way to serve such thing as a HSTS header when doing a redirect ...

It is completely possible that a HTTP redirect response also has an HSTS header. This only means that the HTTP redirect response also contains a Strict-Transport-Security header field with suitable parameters. For example, using SWI-Prolog as HTTP server, you can emit such responses like this:

You can have your redirects like this: