Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

remove includeSubdomains #109

Closed
jgallen23 opened this issue Feb 26, 2015 · 5 comments · Fixed by #111
Closed

remove includeSubdomains #109

jgallen23 opened this issue Feb 26, 2015 · 5 comments · Fixed by #111

Comments

@jgallen23
Copy link

https://github.com/jwilder/nginx-proxy/blob/master/nginx.tmpl#L108

I think includeSubdomains should be removed here. This bit me pretty hard without realizing that dev.app.com and stage.app.com would be automatically redirected to ssl too and I don't have a cert for those urls.
@jwilder
Copy link
Collaborator

jwilder commented Feb 27, 2015

Are you able to override this w/ a custom include? https://github.com/jwilder/nginx-proxy#proxy-wide

@jgallen23
Copy link
Author

the problem is that dev.app.com and stage.app.com are running on different servers and in the case of dev, I'm not running behind nginx, but the browser caches that data so I had to host file a different domain to get it to stop redirecting to https.

@jwilder
Copy link
Collaborator

jwilder commented Feb 28, 2015

I meant override it site-wide at the proxy level to remove the subdomain part. You would add that where you are running nginx-proxy.

@jgallen23
Copy link
Author

Not sure how I would remove the includeSubdomains when overriding. Can you let me know what the conf would have in it?

jwilder added a commit that referenced this issue Feb 28, 2015
@jwilder
Remove includeSubdomains from HSTS header
4a99ac5 
includeSubdomains can lead to issues where not all subdomains are
able to use HTTPS.  This options might be too strict for the general
case: https://www.owasp.org/index.php/HTTP_Strict_Transport_Security.
It can be re-enabled w/ a custom template if needed.

Fixes #109
@jwilder jwilder mentioned this issue Feb 28, 2015
Merged
@jgallen23
Copy link
Author

Thanks

byrnedo pushed a commit to byrnedo/nginx-proxy that referenced this issue May 8, 2015
@jwilder @byrnedo
Remove includeSubdomains from HSTS header
197634d 
includeSubdomains can lead to issues where not all subdomains are
able to use HTTPS.  This options might be too strict for the general
case: https://www.owasp.org/index.php/HTTP_Strict_Transport_Security.
It can be re-enabled w/ a custom template if needed.

Fixes nginx-proxy#109
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Remove includeSubdomains from HSTS header nginx-proxy/nginx-proxy
2 participants
@jgallen23 @jwilder