Add Strict Transport Security to HTTPS-only sites

ISSUE MIGRATED FROM https://gitlab.com/aegir/hosting_https/issues/35 (see #2934484: Move back issue management to D.o)

mlutfy @mlutfy commented 7 months ago

Discussed with Colan:

Since the use-case for "I want https required now, but not tomorrow" is a marginal use-case, it's safe to assume that when "https=required", we can add HSTS headers. It's a sane default.

Colan recommended to add in https://gitlab.com/aegir/hosting_https/blob/master/submodules/nginx_http... (+ equivalent for Apache).

However, in nginx, add_header must be called again if a location block added headers. Therefore, for nginx, this means we would need the add_header to be called in ~/config/includes/nginx_vhost_common.conf:

location = /index.php {
[...]
add_header Cache-Control "no-store, no-cache, must-revalidate, post-check=0, pre-check=0";
add_header Strict-Transport-Security "max-age=15768000";
[...]
}

I suspect it would also be required for the @cache and @drupal location blocks.

Can this be done with a variable?

@memtkmcc Any thoughts?

Adam Andrzej Jaworski @memtkmcc commented a month ago

It belongs only in the /index.php location, and should be doable, since add_header works also within if in the location:

Syntax: add_header name value [always];
Default: —
Context: http, server, location, if in location

But, it should be optional, and not set by default, because otherwise disabling/enabling HTTP->HTTPS redirection via Required/Enabled in the control panel will confuse people.

I mean, in real life people tend to set "Required" instead of "Enabled" encryption from the beginning, without thinking about consequences (like, LE will not generate the working cert because some alias has no valid DNS record, etc.) and then they will lock themselves in the not working HTTPS mode due to HSTS already added and sent.

Making it default for "Required" mode is too optimistic approach. We need to take into account typical user error, and starting with "Required" without understanding what may happen is pretty common.