diff options
| author | nextPrime <nextPrime@users.noreply.github.com> | 2015-04-16 22:22:31 -0400 |
|---|---|---|
| committer | nextPrime <nextPrime@users.noreply.github.com> | 2015-04-16 22:22:31 -0400 |
| commit | d91c109a2c9f319ea4b8f9fc0551fe53b036c971 (patch) | |
| tree | a542821fe0f48f1dcd25d5ed846b67fce44fcaf2 /ssl-config-generator | |
| parent | 90ef2778984b28edb4d062065080012406f68ce0 (diff) | |
| download | server-side-tls-d91c109a2c9f319ea4b8f9fc0551fe53b036c971.zip server-side-tls-d91c109a2c9f319ea4b8f9fc0551fe53b036c971.tar.gz server-side-tls-d91c109a2c9f319ea4b8f9fc0551fe53b036c971.tar.bz2 | |
Change HSTS header setting in Apache
Is it better to use "Header always set Strict-Transport-Security" than "Header always add Strict-Transport-Security", in order to prevent adding duplicate HSTS headers?
Diffstat (limited to 'ssl-config-generator')
| -rw-r--r-- | ssl-config-generator/index.html | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/ssl-config-generator/index.html b/ssl-config-generator/index.html index a349142..7380582 100644 --- a/ssl-config-generator/index.html +++ b/ssl-config-generator/index.html @@ -316,7 +316,7 @@ frontend ft_test } if (data.hstsEnabled == "true") { data.hsts = '\n # HSTS (mod_headers is required) (15768000 seconds = 6 months)' + '\n' + - ' Header always add Strict-Transport-Security "max-age=15768000"'; + ' Header always set Strict-Transport-Security "max-age=15768000"'; } if (isSemVer(data.serverVersion, '>=2.3.16')) { data.sslProtocols = data.sslProtocols.replace(' -SSLv2', ''); |