Real-world HSTS experiences

[Rich Graves]

Sure, do it. No concerns.

Here's some other stuff you can do if you have an Apache proxy in the way. Most can probably be done in Jetty as well.

# Make your default virtual host reject all requests. Only respond if there is
# a correct Host: header. This makes a lot of lame scanners go away.
NameVirtualHost *:443
<VirtualHost *:443>
  ServerName default
  SSLEngine on
  <Location />
    Order deny,allow
    Deny from all
# possibly Allow from your authorized scanner/pen tester
  </Location>
</VirtualHost>
<VirtualHost *:443>
ServerName login.carleton.edu
SSLEngine on
# normal config only within this vhost...

  # 6 month HSTS, tell modern browsers not to use plaintext http transport.
  Header set Strict-Transport-Security "max-age=15768000; includeSubDomains"
  # Prevents wrapping your site in an IFRAME, mitigating clickjacking attacks.
  Header set X-Frame-Options "deny"
  # This stops I.E. from going into "I.E. 7 compatibility mode" which may have security
  # or html display bugs. Assumes you don't have web designers "optimize for I.E."
  Header set X-UA-Compatible "IE=edge"
  # Tells I.E. not to override the server's MIME Content-Type and execute text/plain
  # or image/gif as HTML/JavaScript, which can open XSS possibilities. 
  Header set X-Content-Type-Options "nosniff"
  # Tells older I.E. to look for and block reflected XSS. Most modern browsers have
  # something similar on BY DEFAULT now.
  Header set X-XSS-Protection "1; mode=block"
  # Tell browsers to remember *both* your public key and your CA's public key. If
  # *both* change, assume MITM attack and refuse to connect.
  # https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning
  # https://projects.dm.id.lv/s/pkp-online/calculator.html
  Header set Public-Key-Pins 'pin-sha256="+5MKBBhIf1NMVk2zyvtcSrsMUY+23Jbxrgsasy+lJtI="; pin-sha256="9mfYTsf5flM+gC8TTFkkaZp0QootIRChM0qetgyNp7Y="; max-age=5184000; includeSubDomains'
  # Server enforced HttpOnly;Secure on all cookies.
  # You can set this at the application layer in shib3/jetty9, but for shib2/tomcat it
  # was easier to do it in Apache.
  # Credit http://stackoverflow.com/a/11660223
  Header edit Set-Cookie "(?i)^((?:(?!;\s?HttpOnly).)+)$" "$1; HttpOnly"
  Header edit Set-Cookie "(?i)^((?:(?!;\s?Secure).)+)$" "$1; Secure"
  # Even if bad guys find a way to inject <script> tags, instruct
  # modern browsers not to use images, xss, css from remote sites or
  # misguided/evil Chrome plugins. Alas, shib2 requires "unsafe-inline."
  <Location />
    Header set Content-Security-Policy "connect-src 'self' https://login.carleton.edu; script-src 'self' https://login.carleton.edu https://*.duosecurity.com; style-src 'self' 'unsafe-inline' https://login.carleton.edu https://*.duosecurity.com; report-uri https://csp reports.carleton.edu/"
  </Location>
  <Location /idp>
    Header set Content-Security-Policy "connect-src 'self' https://login.carleton.edu; script-src 'self' https://login.carleton.edu https://*.duosecurity.com 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://login.carleton.edu https://*.duosecurity.com; report-uri https://cspreports.carleton.edu/"
  </Location>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160120/f56fcc19/attachment-0001.html>