HSTS

HTTP Strict Transport Security (HSTS) tells browsers to use HTTPS for a site for a period of time, even when someone types http:// or follows an http:// link. The edge already redirects HTTP to HTTPS; HSTS removes that first unencrypted request.

#How the edge sends it

When hsts.max_age is greater than 0, the edge adds this header to every HTTPS response of the site:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

• includeSubDomains appears only with hsts.include_subdomains, and preload only with hsts.preload.
• The header is never sent on plain HTTP responses.
• When HSTS is on, the edge's value replaces any Strict-Transport-Security header from your origin. When it's off (max_age 0), the origin's header passes through unchanged.

#Settings

Like other edge settings, HSTS can be set for the whole zone or overridden for one name (hosts.<name>.hsts).

#Turn it on

openwaf-cloud ctl zones set example.com hsts.max_age=86400 --reason "HSTS, 1 day to start"
openwaf-cloud ctl zones set example.com hsts.max_age=31536000 hsts.include_subdomains=true --reason "HSTS 1 year"

curl -s -X PATCH https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/edge \
  -H "Authorization: Bearer $OPENWAF_TOKEN" \
  -H "Content-Type: application/json" \
  -H "X-Change-Reason: HSTS 1 year" \
  -d '{"hsts": {"max_age": 31536000, "include_subdomains": true}}'

Check it:

curl -sI https://www.example.com/ | grep -i strict-transport-security

#Preload

Allow preload adds the preload directive, which lets you submit the domain to the HSTS preload list built into browsers. Browsers require a duration of at least 1 year with subdomains included.

#Turn it off

Set hsts.max_age to 0 (Duration › Off). Browsers that already saw the header keep using HTTPS until their stored max-age runs out.