Merge pull request NginxProxyManager#3360 from DarioViva42/hsts-only-…

…with-https only add hsts header with https.
rhasselbusch · Jan 8, 2024 · 09d5e2c · 09d5e2c
2 parents 459b7a2 + 289e438
commit 09d5e2c
Show file tree

Hide file tree

Showing 6 changed files with 15 additions and 1 deletion.
diff --git a/backend/templates/_hsts.conf b/backend/templates/_hsts.conf
@@ -2,7 +2,7 @@
 {% if ssl_forced == 1 or ssl_forced == true %}
 {% if hsts_enabled == 1 or hsts_enabled == true %}
   # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
-  add_header Strict-Transport-Security "max-age=63072000;{% if hsts_subdomains == 1 or hsts_subdomains == true -%} includeSubDomains;{% endif %} preload" always;
+  add_header Strict-Transport-Security $hsts_header always;
 {% endif %}
 {% endif %}
 {% endif %}
diff --git a/backend/templates/_hsts_map.conf b/backend/templates/_hsts_map.conf
@@ -0,0 +1,3 @@
+map $scheme $hsts_header {
+    https   "max-age=63072000;{% if hsts_subdomains == 1 or hsts_subdomains == true -%} includeSubDomains;{% endif %} preload";
+}
diff --git a/backend/templates/_location.conf b/backend/templates/_location.conf
@@ -1,3 +1,5 @@
+  {% include "_hsts_map.conf" %}
+
   location {{ path }} {
     proxy_set_header Host $host;
     proxy_set_header X-Forwarded-Scheme $scheme;

diff --git a/backend/templates/dead_host.conf b/backend/templates/dead_host.conf
@@ -1,6 +1,9 @@
 {% include "_header_comment.conf" %}
 
 {% if enabled %}
+
+{% include "_hsts_map.conf" %}
+
 server {
 {% include "_listen.conf" %}
 {% include "_certificates.conf" %}

diff --git a/backend/templates/proxy_host.conf b/backend/templates/proxy_host.conf
@@ -1,6 +1,9 @@
 {% include "_header_comment.conf" %}
 
 {% if enabled %}
+
+{% include "_hsts_map.conf" %}
+
 server {
   set $forward_scheme {{ forward_scheme }};
   set $server         "{{ forward_host }}";

diff --git a/backend/templates/redirection_host.conf b/backend/templates/redirection_host.conf
@@ -1,6 +1,9 @@
 {% include "_header_comment.conf" %}
 
 {% if enabled %}
+
+{% include "_hsts_map.conf" %}
+
 server {
 {% include "_listen.conf" %}
 {% include "_certificates.conf" %}