www.-instance not 100% - missing HSTS

[bwbroersma]

See the current score of www.internet.nl, thanks @mxsasha for noticing.

The www.-variant is defined here:

Internet.nl/docker/webserver/nginx_templates/app.conf.template

Lines 115 to 140 in 894aa04

	# No-www.org Class B compliance, see https://www.no-www.org/faq.php
	server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;
	server_name www.${INTERNETNL_DOMAINNAME} ~(nl|en|conn)\.www.${INTERNETNL_DOMAINNAME} ${REDIRECT_DOMAINS_LIST};
	ssl_protocols TLSv1.2 TLSv1.3;
	ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
	ssl_certificate /etc/letsencrypt/live/${INTERNETNL_DOMAINNAME}/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/${INTERNETNL_DOMAINNAME}/privkey.pem;
	# letsencrypt/ACME
	location /.well-known/acme-challenge/ {
	# basic auth should not apply to this path
	auth_basic off;
	# IP allowlist should also not apply
	allow all;
	}
	# redirect to no-www domainname
	location ~ /(.*) {
	return 301 https://${INTERNETNL_DOMAINNAME}$request_uri;
	}
	}

only serving the default headers, which don't include a HSTS header (because plain HTTP should not have a HSTS):

Internet.nl/docker/webserver/nginx_templates/app.conf.template

Lines 16 to 21 in 894aa04

	# default headers added to all responses
	add_header 'X-Frame-Options' 'SAMEORIGIN' always;
	add_header 'X-Content-Type-Options' 'nosniff' always;
	add_header 'X-Clacks-Overhead' 'GNU Terry Pratchett' always;
	add_header 'Referrer-Policy' 'same-origin' always;
	add_header 'X-XSS-Protection' '1; mode=block' always;

So

• Short term solution: add all default + HSTS + CSP headers in the server block
• Long term: cleanup the nginx file and make use of files to include default headers, so the same defaults are not repeated all over the file.

[bwbroersma]

🎉 The test of www.internet.nl is 💯% again.