HSTS Preload problem: site is not configured to redirect to https first (before redirecting to www/non-www)

- ☆ A M B ☆
- 106 Posts
Gerben Reply #1, 8 years, 6 months ago

I tried to install the HSTS header in my htacces file and tested it on the HSTS site (https://hstspreload.org/). I got the following error:

"Error: HTTP redirects to www first`http://mysite.nl` (HTTP) should immediately redirect to `https://mysite.nl` (HTTPS) before adding the www subdomain. Right now, the first redirect is to `https://www.mysite.nl/`. The extra redirect is required to ensure that any browser which supports HSTS will record the HSTS entry for the top level domain, not just the subdomain."

It seems the default MODX htaccess redirects domains first to www/non-www, and then to https. It should be the other way around to get the HSTS header working.

I found this explanation:
"We should redirect HTTP requests to their HTTPS equivalent before any canonicalization steps (adding or removing “www”), and send the HSTS header from any domain or subdomain that is meant to be only accessible over HTTPS:"
(https://www.sentinelstand.com/article/http-strict-transport-security-hsts-canonical-www-redirects)

Anyone got a clue?
- 24,544 Posts
BobRay Reply #2, 8 years, 6 months ago
My site does the https rewrite and the www removal at the same time (the extra lines are for LetsEncrypt):
```
RewriteCond %{HTTP_HOST} .
RewriteCond %{HTTP_HOST} !^mysite\.com [NC]
RewriteCond %{REQUEST_URI} !^/[0-9]+\..+\.cpaneldcv$
RewriteCond %{REQUEST_URI} !^/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/[0-9a-zA-Z_-]+$
RewriteRule (.*) https://mysite.com/$1 [R=301,L]
```
I don't know if that would cause trouble with the HSTS or not. I've hesitated to try it, since it appears to be a pain to get off the list and I'm not convinced of the long-term benefits.
Did I help you? Buy me a beer
Get my Book: MODX:The Official Guide
MODX info for everyone: http://bobsguides.com/modx.html
My MODX Extras
Bob's Guides is now hosted at A2 MODX Hosting