Nginx / Apache：只有当X-Forwarded-Proto是https时才设置HSTS

我得到了以下设置：

Internet => nginx[public:80 +443, SSL termination) => Varnish[localhost:81] => Apache[localhost:82] 

现在有些网站只能通过HTTPS和有效的SSL证书进行访问。 对于这几个例外，我想激活HSTS，无论是nginx（首选，或在Apache）。

问题：

• 在nginx上， if Host = foo.tld则需要一些逻辑，然后设置Strict-Transport-Security xxx ，但根据http://wiki.nginx.org/IfIsEvil， if在某个location
• 在Apache上，我需要类似于if X-Forwarded-Proto 443 set Strict-Transport-Security xxx ，但我似乎不能用SetEnvIf （Apache 2.2）

我的逻辑是否有缺陷？ 另一种方法的想法？

• Apache Kerberos身份validation到Active Directory不会发生。 （与KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN有关吗？）
• Apache和MySQL的HAProxy平衡algorithm
• 了解Apache扩展服务器状态的CPU％
• networking服务器SSD升级：会不会部分FS切换呢？
• Apache虚拟主机（Ubuntu）的错误文档根

这是当前活动的configuration：

nginx的

服务器{
         server_tokensclosures;

        听xx.xx.xxx.xxx:80;
         server_name localhost;

        位置 / {
                 proxy_pass http://127.0.0.1:81;
                 proxy_set_header X-Real-IP $ remote_addr;
                 proxy_set_header X-Forwarded-For $ proxy_add_x_forwarded_for;
                 proxy_set_header X-Forwarded-Proto $ scheme;
                 proxy_set_header X-Forwarded-Port 80;
                 proxy_set_header主机$主机;
                 add_header X-XSS-Protection“1; mode = block”;
         }
 }

服务器{
         server_tokensclosures;

        听xx.xx.xxx.xxx:443 ssl;
         server_name localhost;

         ssl;
         ssl_certificate /etc/ssl/foo.crt;
         ssl_certificate_key /etc/ssl/private/foo.key;

         ssl_session_timeout 10m;

         ＃http://blog.ivanristic.com/2013/08/configuring-apache-nginx-and-openssl-for-forward-secrecy.html
         ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
         ssl_prefer_server_ciphers;
         ssl_ciphers“EECDH + ECDSA + AESGCM EECDH + aRSA + AESGCM EECDH + ECDSA + SHA384 EECDH + ECDSA + SHA256 EECDH + aRSA + SHA384 EECDH + aRSA + SHA256 EECDH + aRSA + RC4 EECDH EDH + aRSA RC4！aNULL！eNULL！LOW！3DES ！MD5！EXP！PSK！SRP！DSS“;

        位置 / {
                 proxy_pass http://127.0.0.1:81;
                 proxy_set_header X-Real-IP $ remote_addr;
                 proxy_set_header X-Forwarded-For $ proxy_add_x_forwarded_for;
                 proxy_set_header X-Forwarded-Proto $ scheme;
                 proxy_set_header X-Forwarded-Port 443;
                 proxy_set_header主机$主机;
                 add_header X-XSS-Protection“1; mode = block”;
         }
 }

漆

没有特别的configuration。

阿帕奇

 <VirtualHost *:82> [...] nothing special </VirtualHost> 

 server { listen xx.xx.xxx.xxx:443 ssl default_server; # all ssl stuff # and other directives } server { listen xx.xx.xxx.xxx:443 ssl; server_name example.com other.example.com; # all ssl stuff # and other directives with HSTS enabled } 

 map $scheme:$host $hsts_header { default ""; https:example.com "max-age=31536000"; https:other.example.com "max-age=31536000"; } server { server_tokens off; listen xx.xx.xxx.xxx:80; listen xx.xx.xxx.xxx:443 ssl; ssl_certificate /etc/ssl/foo.crt; ssl_certificate_key /etc/ssl/private/foo.key; ssl_session_timeout 10m; # ... other ssl stuff location / { proxy_pass http://127.0.0.1:81; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Port $server_port; proxy_set_header Host $host; add_header X-XSS-Protection "1; mode=block"; add_header Strict-Transport-Security $hsts_header; } }