You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Zoltán Halassy <cf...@gmail.com> on 2014/11/13 14:13:30 UTC

[users@httpd] VirtualHost conditionless HSTS

Hello!

Working with Apache 2.4.

I wanted to configure an https host with HSTS:

<VirtualHost *:443>
    [...]
    Header set Strict-Transport-Security "max-age=31556952"
    <Directory "/var/www/...">
        Require all granted
        [...]
    </Directory>
    [...]
</VirtualHost>

This works fine. However as soon as I require HTTP authentication on
apache level, the Header directive stops working for unauthenticated
users. Even if I provide "early" after the directive:

    Header set Strict-Transport-Security "max-age=31556952"
    <Directory "/var/www/...">
        Require valid-user
        AuthType ...
        [...]
    </Directory>

or

    Header set Strict-Transport-Security "max-age=31556952" early
    <Directory "/var/www/...">
        Require valid-user
        AuthType ...
        [...]
    </Directory>

Neither provides the HSTS header to an unauthenticated user. Is there
a simple way to inject the HSTS (or any) header to unauthenticated
users?

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: [users@httpd] VirtualHost conditionless HSTS

Posted by Zoltán Halassy <cf...@gmail.com>.
Oh thanks, this is exactly I was looking for. I totally missed it in
the documentation. It's there.

Thank you.

2014-11-13 14:30 GMT+01:00 Eric Covener <co...@gmail.com>:
>> Neither provides the HSTS header to an unauthenticated user. Is there
>> a simple way to inject the HSTS (or any) header to unauthenticated
>> users?
>
> If it's the 401 that you want to have the header, you'll need
>
>   Header always set ...
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: [users@httpd] VirtualHost conditionless HSTS

Posted by Eric Covener <co...@gmail.com>.
> Neither provides the HSTS header to an unauthenticated user. Is there
> a simple way to inject the HSTS (or any) header to unauthenticated
> users?

If it's the 401 that you want to have the header, you'll need

  Header always set ...

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org