From cff0eff8c7aa8471330edc449b7c5e1ec4f5894c Mon Sep 17 00:00:00 2001 From: Morris Jobke Date: Sun, 14 May 2017 23:02:20 -0500 Subject: [PATCH] Add notice about HSTS preload option Signed-off-by: Morris Jobke --- .../configuration_server/harden_server.rst | 17 ++++++++++++++--- .../installation/nginx_nextcloud_9x.rst | 12 ++++++++++++ 2 files changed, 26 insertions(+), 3 deletions(-) diff --git a/admin_manual/configuration_server/harden_server.rst b/admin_manual/configuration_server/harden_server.rst index e515a4b5a..93367b40f 100644 --- a/admin_manual/configuration_server/harden_server.rst +++ b/admin_manual/configuration_server/harden_server.rst @@ -119,11 +119,22 @@ VirtualHost file:: ServerName cloud.nextcloud.com - Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains; preload" + Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains" - -This example configuration will make all subdomains only accessible via HTTPS. If you have subdomains not accessible via HTTPS, remove ``includeSubdomains;``. + +.. warning:: + We recommend the additional setting ``; preload`` to be added to that header. + Then the domain will be added to an hardcoded list that is shipped with all + major browsers and enforce HTTPS upon those domains. See the `HSTS preload + website for more information `_. Due to the policy + of this list you need to add it to the above example for yourself once you + are sure that this is what you want. `Removing the domain from this list + `_ could take some months until it reaches + all installed browsers. + +This example configuration will make all subdomains only accessible via HTTPS. +If you have subdomains not accessible via HTTPS, remove ``includeSubdomains;``. This requires the ``mod_headers`` extension in Apache. diff --git a/admin_manual/installation/nginx_nextcloud_9x.rst b/admin_manual/installation/nginx_nextcloud_9x.rst index 029af8172..f706c683d 100644 --- a/admin_manual/installation/nginx_nextcloud_9x.rst +++ b/admin_manual/installation/nginx_nextcloud_9x.rst @@ -44,6 +44,12 @@ your nginx installation. # topic first. # add_header Strict-Transport-Security "max-age=15768000; # includeSubDomains; preload;"; + # + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. add_header X-Content-Type-Options nosniff; add_header X-Frame-Options "SAMEORIGIN"; add_header X-XSS-Protection "1; mode=block"; @@ -128,6 +134,12 @@ your nginx installation. # this topic first. # add_header Strict-Transport-Security "max-age=15768000; # includeSubDomains; preload;"; + # + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. add_header X-Content-Type-Options nosniff; add_header X-Frame-Options "SAMEORIGIN"; add_header X-XSS-Protection "1; mode=block";