My web application runs on a different number of hosts that I control. To prevent the need to change the Apache config of each vhost, I add most of the config using .htaccess files in my repo so the basic setup of each host is just a couple of lines. This also makes it possible to change the config upon deploying a new version. Currently the .htaccess (un)sets headers, does some rewrite magic and controls the caching of the UA.
I want to enable HSTS in the application using .htaccess. Just setting the header is easy:
Header always set Strict-Transport-Security "max-age=31536000"
But the spec clearly states: “An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.”. So I don’t want to send the header when sending it over HTTP connections.
I tried to set the header using environment vars, but I got stuck there. Anyone that knows how to do that?
Answer
Apparently there is a HTTPS environment variable available that can be used easily. For people with the same question:
Header set Strict-Transport-Security "max-age=31536000" env=HTTPS
I used the following in the .htaccess to meet the secure deployment recommendations at https://hstspreload.org which will hardcode the domain into the Chrome browser. Be aware this will enforce HSTS across your subdomains, and that inclusion in the preload list cannot easily be undone, so rtfm.
<IfModule mod_headers.c>
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS
</IfModule>
You can use this and put it on your htaccess file to comply with https://hstspreload.org. put this in your .htaccess file.
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}/$1 [R=301,L,E=HTTPS:1]
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS
first, it will do redirection for non https to https. and redirect non www https to www https with HSTS header.