Configure the hsts plug-in-Microservices Engine(MSE)-阿里云帮助中心

HTTP Strict Transport Security (HSTS) tells browsers to connect to your domain over HTTPS only. After a browser receives the HSTS header, it upgrades all subsequent HTTP requests to HTTPS locally through a 307 Internal Redirect. This eliminates extra server round-trips and closes the window for downgrade attacks.

Plug-in type: Throttling

How it works

The HSTS plug-in adds a Strict-Transport-Security response header to every HTTPS response from the gateway. Once a browser caches this header, it automatically converts all HTTP requests to the domain into HTTPS requests before they leave the browser.

This differs from a server-side HTTPS redirect (301 or 302) in two ways:

No extra round-trip. The browser upgrades the request locally, so the user is never exposed to an unencrypted HTTP request.
Protection against downgrade attacks. The browser never sends an HTTP request, so an attacker cannot intercept and redirect the user to a malicious site.

Note

The plug-in adds the Strict-Transport-Security header to HTTPS responses only. HTTP responses do not include the header, which follows the behavior defined in RFC 6797.

Prerequisites

Before you enable the HSTS plug-in, make sure that you have:

A valid TLS/SSL certificate configured for your domain on the Microservices Engine (MSE) cloud-native gateway
HTTPS enabled and verified for all domains and subdomains that the policy will cover

Warning

After HSTS is active, browsers refuse HTTP connections for the entire max_age duration. If you disable HTTPS or let your TLS certificate expire while the policy is cached, your domain becomes inaccessible to returning visitors until the policy expires. Keep HTTPS operational for the full max_age period.

Configuration fields

Field	Type	Required	Default	Description
`max_age`	number	No	15724800 (~182 days)	Duration, in seconds, for which browsers enforce HTTPS-only connections to the domain.
`include_sub_domains`	bool	No	false	When set to `true`, applies the HSTS policy to the domain and all its subdomains.

Configuration example

{
  "max_age": 31536000,
  "include_sub_domains": true
}

This configuration enforces HTTPS for the domain and all subdomains for one year (31,536,000 seconds).

Deploy to production

Start with a short max_age for testing. Set max_age to a small value (for example, 300 for 5 minutes). Verify that all pages load correctly over HTTPS before you increase the duration.
Verify subdomain HTTPS support before you enable include_sub_domains. When include_sub_domains is true, every subdomain must have a valid TLS certificate. Any subdomain without HTTPS becomes inaccessible to browsers that have cached the HSTS policy.
Do not disable HTTPS while HSTS is active. Browsers that have cached the Strict-Transport-Security header refuse HTTP connections for the entire max_age window. Removing HTTPS during this period locks out returning visitors.