HAProxy HSTS Preloading



  • Dear All,

    The option to enable HSTS (HTTP strict transport security, https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) in HAProxy is very good, I think. A slight step further should be the use of HSTS preloading (https://hstspreload.appspot.com/). That, however requires the HSTS header containing not only "max-age", as the HAProxy package does nicely generate, but also "includeSubDomains; preload". Would it be reallistic to include these options in the package?

    Regards,

    Michael Schefczyk



  • Hi Michael,

    It would indeed be a step further, but i think its a rather 'dangerous' option if i understand it correctly..If you dont think it through you might loose access to http only sites on the same domain that you/someone forgot where running as well.. Ill put it on my todo list though.

    Regards,
    PiBa-NL


Log in to reply