The "Strict-Transport-Security" HTTP header is not set to at least "15552000" seconds.

[vonkraus]

Hello, I apologize if this has been asked before, I searched throughout this git to see if there was anything related, but didn't find anything.

I'm running Unraid 6.12.6 with Nginx for my proxy to my website for Nextcloud. Checking the Nextcloud security and setup warnings page, I get the warning - The "Strict-Transport-Security" HTTP header is not set to at least "15552000" seconds. The docs for nextcloud tell me to set this in the nginx.conf file. I do set these values are restart both NC and Nginx containers on Unraid, but nothing changes and keep getting the same error. Anyone know where I'm going wrong?

Thanks in advance!

[blaine07]

In Nextcloud appdata folder - there is a ssl.conf - do you have it enable/disabled there?

Line 21:

[vonkraus]

I suppose I should have mentioned the rev of nextcloud. I've tried the following versions in the apps "store" knex666, Linux server, kilrahs and none of them have an ssl.conf file. They used to as that is where I configured this setting before. (I've been comparing truenas and unraid and I'm going with unraid)
What's the recommended nextcloud rev to use?

[blaine07]

LinuxServer.IO's is the ONE to use IMO.

[vonkraus]

How would I get ffmpeg support in the linuxserv version?

[vonkraus]

I think the memories app inside of Nextcloud adds that function...

[vonkraus]

I have an update. If you go into the following path and add the recommendations to your proxy conf files; to correct the red flags from a scan of your website from this scan tool: https:// securityheaders dot com/ This is the way I was able to fix the STS Header errors.

[ARVEDz]

I have to open this again, unfortunately. I get an A+ on securityheaders.com but my internal security check in nextcloud still states:

Some headers are not set correctly on your instance - The Strict-Transport-Security HTTP header is not set (should be at least 15552000 seconds). For enhanced security, it is recommended to enable HSTS. For more details see the documentation ↗.

I am running nextcloud via docker with Nginx Proxy Manager.

Any Idea or tips, what I should check?

Thanks in advance

Best Regards
Arved

[drybx]

Did you figure it out in the meantime? I'm having the same issue

[popy2k14]

Same issue here, any hints?

[TomSaw]

Me too, sad times :(

[rmlanghopto]

If you add:

Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"

under the <IfModule mod_env.c> section of the .htaccess in your root Nextcloud folder, that worked for me.

Edit: I'm using Nextcloud's official, stable image in Docker with NPM proxying it.

[drybx]

If you add:

Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"

under the <IfModule mod_env.c> section of the .htaccess in your root Nextcloud folder, that worked for me.

Edit: I'm using Nextcloud's official, stable image in Docker with NPM proxying it.

That worked for me. Thanks!