blocks|key|2192565|text|也许吧?+--解决了我过去遇到过的类似情况。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2192566|entityMap|0|LINK|mutability|MUTABLE|url|http://tobschall.de/2015/03/05/perfect-aws-ec2-elb-configuration/^0|0|4|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

<a href="http://tobschall.de/2015/03/05/perfect-aws-ec2-elb-configuration/" rel="nofollow noreferrer">Maybe?</a> - Did resolve a similar scenario I had in the past.

blocks|key|558930|text|我询问了AWS的支持，答案是目前ELB无法在来自客户端的请求中添加HSTS头。因此，我决定使用我的Apache服务器找到一个解决办法。下面是我找到的解决方案：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|558931|HSTS+RFC指出：|offset|length|558932|HSTS主机不能在通过非安全传输传送的HTTP响应中包含STS标头字段。|blockquote|558933|我当时所做的是在、http=>https重定向之后设置头http=>https。由于此重定向具有标志L，这意味着301重定向将不包括标头，但是任何https请求都会。我的apache配置如下所示：|558934|<VirtualHost+*:80>
...
++++#http=>https
++++RewriteCond+%25{HTTP:X-Forwarded-Proto}+=http
++++RewriteRule+.+https://%25{HTTP:Host}%25{REQUEST_URI}+[L,R=permanent]

++++#hsts
++++Header+set+Strict-Transport-Security+"max-age=31536000"|code-block|syntax|javascript|558935|entityMap|0|LINK|mutability|MUTABLE|url|https://www.rfc-editor.org/rfc/rfc6797#section-7.2^0|0|0|8|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|X|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Y|8|@]|9|@$D|Z|E|10|1|11]]|A|$]]|$1|F|3|G|5|H|7|12|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|13|8|@]|9|@]|A|$]]|$1|K|3|L|5|M|7|14|8|@]|9|@]|A|$N|O]]|$1|P|3|-4|5|6|7|15|8|@]|9|@]|A|$]]]|Q|$R|$5|S|T|U|A|$V|W]]]]

I asked the AWS Support and the answer was that at the moment ELB cannot add HSTS headers on the requests from the clients. So, I decided to find a workaround using my Apache server. Here is the solution I found:
The <a href="https://www.rfc-editor.org/rfc/rfc6797#section-7.2" rel="nofollow noreferrer">HSTS RFC</a> states that
<blockquote>
An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.
</blockquote>
What I did then was to set the header AFTER the http=&gt;https redirection in Apache. Since this redirection has the flag [L], that means that the 301 redirection will not include the header, but any https request will. My apache config looks like this:
<pre><code>&lt;VirtualHost *:80&gt;
...
 #http=&gt;https
 RewriteCond %{HTTP:X-Forwarded-Proto} =http
 RewriteRule . https://%{HTTP:Host}%{REQUEST_URI} [L,R=permanent]

 #hsts
 Header set Strict-Transport-Security &quot;max-age=31536000&quot;
</code></pre>

blocks|key|283452|text|如果您正在使用Apache+2.4%2B，您可能熟悉表达和指令<If>、<ElseIf>和<Else>。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|283453|我在开发环境、暂存环境和生产环境之间有一个复杂的配置，所以依赖带有[L]标志的RewriteRule不会为我削减它。|283454|这给我带来了下面的解决方案，我把它放在了我的.htaccess中|283455|<IfModule+mod_headers.c>
++++<If+"%25{REQUEST_SCHEME}+==+'https'+%7C%7C+%25{HTTP:X-Forwarded-Proto}+==+'https'">
++++++++Header+set+Strict-Transport-Security+"max-age=31536000"
++++</If>
</IfModule>|code-block|syntax|javascript|283456|它在我的环境中工作得更好，我觉得它对于满足RFC来说更可靠。|283457|如果从未直接命中实例，则可以删除"%25{REQUEST_SCHEME}+==+'https'部分，但这是我在dev环境中调试过程的一部分。|283458|非常感谢佩德雷罗为HSTS的实际规范指出了正确的方向。|283459|entityMap|0|LINK|mutability|MUTABLE|url|https://httpd.apache.org/docs/2.4/expr.html|1|https://stackoverflow.com/users/2116873/pedreiro^0|T|4|Y|8|17|6|O|2|0|0|X|3|13|B|0|0|0|0|G|T|0|4|4|1|0^^$0|@$1|2|3|4|5|6|7|14|8|@$9|15|A|16|B|C]|$9|17|A|18|B|C]|$9|19|A|1A|B|C]]|D|@$9|1B|A|1C|1|1D]]|E|$]]|$1|F|3|G|5|6|7|1E|8|@$9|1F|A|1G|B|C]|$9|1H|A|1I|B|C]]|D|@]|E|$]]|$1|H|3|I|5|6|7|1J|8|@]|D|@]|E|$]]|$1|J|3|K|5|L|7|1K|8|@]|D|@]|E|$M|N]]|$1|O|3|P|5|6|7|1L|8|@]|D|@]|E|$]]|$1|Q|3|R|5|6|7|1M|8|@$9|1N|A|1O|B|C]]|D|@]|E|$]]|$1|S|3|T|5|6|7|1P|8|@]|D|@$9|1Q|A|1R|1|1S]]|E|$]]|$1|U|3|-4|5|6|7|1T|8|@]|D|@]|E|$]]]|V|$W|$5|X|Y|Z|E|$10|11]]|12|$5|X|Y|Z|E|$10|13]]]]

If you're working with Apache 2.4+, you may be familiar with <a href="https://httpd.apache.org/docs/2.4/expr.html" rel="noreferrer">expressions</a> and the directives <code>&lt;If&gt;</code>, <code>&lt;ElseIf&gt;</code>, and <code>&lt;Else&gt;</code>.

I have a complex configuration between dev, staging, and production environments, so relying on the <code>[L]</code> flag with the <code>RewriteRule</code> just wouldn't cut it for me.

This brought me to the following solution, which I placed in my .htaccess:

<pre><code>&lt;IfModule mod_headers.c&gt;
 &lt;If "%{REQUEST_SCHEME} == 'https' || %{HTTP:X-Forwarded-Proto} == 'https'"&gt;
 Header set Strict-Transport-Security "max-age=31536000"
 &lt;/If&gt;
&lt;/IfModule&gt;
</code></pre>

It works better in my environment and I feel that it is more reliable for meeting the RFC.

You could drop the <code>"%{REQUEST_SCHEME} == 'https'</code> part if you never hit your instances directly, but that's part of my debug process in my dev environments.

Much thanks to <a href="https://stackoverflow.com/users/2116873/pedreiro">Pedreiro</a> for pointing me in the right direction for the actual specifications on the HSTS RFC.

blocks|key|283477|text|请注意，由于Apache+<+2.4不支持这一点，所以最好将其封装在<IfVersion+>=+2.4>中，如下所示：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|283478|++++<IfVersion+>=+2.4>+
++++++++<IfModule+mod_headers.c>
++++++++++++<If+"%25{REQUEST_SCHEME}+==+'https'+%7C%7C+%25{HTTP:X-Forwarded-Proto}+==+'https'">
++++++++++++++++Header+set+Strict-Transport-Security+"max-age=31536000;+includeSubDomains;+preload"
++++++++++++</If>
++++++++</IfModule>
++++</IfVersion>|code-block|syntax|javascript|283479|entityMap^0|Y|I|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@$9|N|A|O|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|P|8|@]|D|@]|E|$I|J]]|$1|K|3|-4|5|6|7|Q|8|@]|D|@]|E|$]]]|L|$]]

Please note that since this is not supported for Apache &lt; 2.4, it's best to encapsulate it in <code>&lt;IfVersion &gt;= 2.4&gt;</code>, like so:

<pre><code> &lt;IfVersion &gt;= 2.4&gt; 
 &lt;IfModule mod_headers.c&gt;
 &lt;If "%{REQUEST_SCHEME} == 'https' || %{HTTP:X-Forwarded-Proto} == 'https'"&gt;
 Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
 &lt;/If&gt;
 &lt;/IfModule&gt;
 &lt;/IfVersion&gt;
</code></pre>

I would like to implement HSTS to my application.

I have an ELB terminating SSL and forwarding the traffic to my application, which is an apache server used as reverse proxy. 

I know that in order to implement HSTS, I would need to add the header Strict-Transport-Security to my request.

Unfortunately, it seems that I cannot implement it on my Apache server as it would have to be added to the HTTPS Virtual Host and my Apache only has the http virtual host configured, since the SSL is terminated on the ELB.

That means that the ELB would have to add the header Strict-Transport-Security to the request when it pass it forward.

How do I do that? Can I add some sort of security policy that would do that for me?

How to implement HTTP Strict Transport Security (HSTS) on AWS Elastic Load Balancer?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋 

腾讯云代码助手

CODING DevOps

Cloud Studio

SDK中心

API中心

命令行工具

我想在我的应用程序中实现HSTS。我有一个ELB终止SSL并将流量转发给我的应用程序，这是一个用作反向代理的apache服务器。我知道，为了实现HSTS，我需要将头严格-传输-安全性添加到我的请求。不幸的是，我似乎无法在Apache服务器上实现它，因为它必须添加到HTTPS虚拟主机中，而且我的Apache只配置了htt...

问如何在AWS弹性负载均衡器上实现HTTP严格传输安全？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在AWS弹性负载均衡器上实现HTTP严格传输安全？EN