Enabling HSTS through Fastly

The HTTP Strict Transport Security (HSTS) security enhancement specification provides a way to force modern browsers to communicate only via the Transport Layer Security (TLS) protocol. Once enabled, HSTS will force the browser to redirect (typically with a status code 307) to the HTTPS URL as long as the URL has previously been visited. For example, making a request for http://www.example.com would force a redirect to https://www.example.com as long as https://www.example.com has been visited once before.

NOTE

Because HSTS only takes effect after a site has been visited on a trusted HTTPS connection, we recommend forcing TLS and enabling HSTS. If you’d prefer not to automatically enable HSTS, you can still manually enable it after setting up TLS redirects.

Prerequisites

These instructions assume that you've set up TLS service with Fastly.

Forcing TLS and enabling HSTS

To force TLS and enable HSTS, follow these steps.

NOTE

Services activated using a previous version of the Force TLS controls may temporarily display an additional, older testing duration. Once you select the recommended new testing duration, this older option will disappear.

1. Log in to the Fastly web interface.
2. From the All services page, select the appropriate service. You can use the search box to search by ID, name, or domain.
3. Click the Edit configuration button and then select the option to clone the active version. The Domains page appears.
4. Click the Settings link. The Settings page appears.
5. If you have Force TLS enabled for any request settings without a condition, conflicts in the VCL logic may occur. Delete the existing request setting or modify it to add a condition.

6. Click the Force TLS and enable HSTS switch to force TLS and enable HSTS for the service.

   

   The request setting for forcing TLS and the header for enabling HSTS will automatically be created for you.

7. Click the Activate button to deploy your configuration changes.

WARNING

You may experience problems if you enable this setting along with the override host setting. Instead of enabling the override host setting, create a new request setting and specify the override host in the advanced options.

Manually enabling HSTS

If you'd like configure additional HSTS options, you'll need to manually enable HSTS by adding a new header as follows.

NOTE

If you followed the instructions in the previous section, click the Force TLS and enable HSTS switch to remove the request setting and header that were automatically created.

1. Follow the instructions in forcing a TLS redirect to force unencrypted requests over to TLS.
2. Click the Content link. The Content page appears.

3. Click the Create header button to create a new header. The Create a header page appears.

   

4. Fill out the Create a header fields as follows:
   • In the Name field, enter a human-readable name, such as HSTS. This name is displayed in the Fastly web interface.
   • From the Type menu, select Response, and from the Action menu select Set.
   • In the Destination field, enter http.Strict-Transport-Security.
   • In the Source field, enter "max-age=<max age in seconds>". For example, "max-age=31536000". As described below, max-age is required and two additional HSTS options can be specified.
   • Leave the Ignore if set menu and the Priority field set to their defaults (or set them as appropriate for your service).
5. Click the Create button.
6. Click the Activate button to deploy your configuration changes.

HSTS options

If you manually configured the HSTS header, you can specify additional HSTS options.

HSTS requires the max-age directive be set in order to function properly. It specifies how long in seconds to remember that the current domain should only be contacted over HTTPS. The example shown above sets max-age to one year (31536000 seconds = 1 year). You may want to experiment using a smaller value than what is shown.

Two additional options can be specified with the HSTS response header:

• includeSubdomains - This token applies HSTS to all of your site's subdomains. Before you include it, be certain none of your subdomains require functionality on HTTP in a browser. Ensure your TLS certificate is a wildcard or has coverage for all subdomain possibilities.

  IMPORTANT

  All subdomains will be unreachable on HTTP by browsers that have seen the HSTS header once includeSubdomains is enabled.

• preload - This token allows you to submit your domain for inclusion in a preloaded HSTS list that is built into several major browsers. Although the token is not part of the HSTS specification, including it in the header is a prerequisite for submitting to this preloaded list.

  WARNING

  Don't request browser preload inclusion unless you're sure that you can support HTTPS for the long term. Inclusion in the HSTS Preload List cannot be undone easily. See https://hstspreload.org/ for submission instructions and more information.

Combining all of these options together in the Source field would look like this:

"Strict-Transport-Security: max-age=<max age in seconds>; includeSubDomains; preload"

To disable HSTS for whatever reason, simply set the max-age to 0 on an HTTPS connection.

Additional reading

• RFC 6797, which describes the HSTS specification
• the Wikipedia description of HSTS, including the currently known limitations and a browser support list
• the OWASP.org explanation of HSTS, including descriptions of the threats it addresses
• the Chromium Projects description of HSTS and preloading HSTS sites

Was this guide helpful?

Yes No Comment only

Tell us what worked and what we could do better.

Do not use this form to send sensitive information. If you need assistance, contact support@fastly.com.