HSTS (with Nginx) does not work properly

Hello,

In case someone stumbles upon this question, It seems that the issue is with the configuration of the HSTS header. The HSTS header is sent to the browser on the first request and instructs the browser to only access the website over HTTPS for the duration specified in the header. In your configuration, the max-age of the HSTS header is set to 60 seconds, which is a very short duration. This means that after 60 seconds, the browser will no longer enforce HTTPS and will allow HTTP access to the website.

To fix this issue, you should increase the duration of the max-age parameter in the HSTS header to a longer period, such as 31536000 seconds (1 year). You can also consider adding the preload parameter to the header, which will include your website in the HSTS preload list maintained by major browsers. This will ensure that even new visitors to your website will always access it over HTTPS, even if they have never visited your website before.

Here is the updated configuration with the changes to the HSTS header:

server {
    listen 80;
    server_name *.example.com;
    return 301 https://example.com$request_uri;
}

server {
    server_name <droplet ip address> example.com;
    listen 443 ssl http2;

    # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    location = /favicon.ico { access_log off; log_not_found off; }
    location /static/ {
        root /home/example;
    }

    location / {
        include proxy_params;
        proxy_pass http://unix:/home/example/example.sock;
    }
}

Note that I also updated the configuration to include the http2 parameter on the SSL listener, which enables HTTP/2 support. This should improve the performance of your website.

Hello,

In case someone stumbles upon this question, It seems that the issue is with the configuration of the HSTS header. The HSTS header is sent to the browser on the first request and instructs the browser to only access the website over HTTPS for the duration specified in the header. In your configuration, the max-age of the HSTS header is set to 60 seconds, which is a very short duration. This means that after 60 seconds, the browser will no longer enforce HTTPS and will allow HTTP access to the website.

To fix this issue, you should increase the duration of the max-age parameter in the HSTS header to a longer period, such as 31536000 seconds (1 year). You can also consider adding the preload parameter to the header, which will include your website in the HSTS preload list maintained by major browsers. This will ensure that even new visitors to your website will always access it over HTTPS, even if they have never visited your website before.

Here is the updated configuration with the changes to the HSTS header:

server {
    listen 80;
    server_name *.example.com;
    return 301 https://example.com$request_uri;
}

server {
    server_name <droplet ip address> example.com;
    listen 443 ssl http2;

    # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    location = /favicon.ico { access_log off; log_not_found off; }
    location /static/ {
        root /home/example;
    }

    location / {
        include proxy_params;
        proxy_pass http://unix:/home/example/example.sock;
    }
}

Note that I also updated the configuration to include the http2 parameter on the SSL listener, which enables HTTP/2 support. This should improve the performance of your website.