HSTS header not being sent though rule is present and mod_headers is enabled

Question

We enabled HSTS in httpd.conf in the Virtual Host handling port 443. We tried with and without the <IfModule mod_headers.c>:

<IfModule mod_headers.c>
    Header set Strict-Transport-Security "max-age=10886400; includeSubDomains"
</IfModule>

But the server does not include the header in a response. Below is from curl over HTTPS:

> GET / HTTP/1.1
> Host: www.cryptopp.com
> User-Agent: curl/7.51.0
> Accept: */*
> 
< HTTP/1.1 200 OK
< Date: Sat, 05 Nov 2016 22:49:25 GMT
< Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips
< Last-Modified: Wed, 02 Nov 2016 01:27:08 GMT
< ETag: "8988-5404756e12afc"
< Accept-Ranges: bytes
< Content-Length: 35208
< Vary: Accept-Encoding
< Content-Type: text/html; charset=UTF-8

The relevant section of httpd.conf is shown below. The cURL transcript is shown below. Apache shows mod_header is loaded, and grepping all the logs don't reveal an error.

The Apache version is Apache/2.4.6 (CentOS). The PHP version is 5.4.16 (cli) (built: Aug 11 2016 21:24:59). The Mediawiki version is 1.26.4.

What might be the problem here, and how could I solve this?

httpd.conf

<VirtualHost *:80>
    ServerName www.cryptopp.com
    ServerAlias *.cryptopp.com *.cryptopp.* cryptopp.com

    <IfModule mod_rewrite.c>
        RewriteEngine On
        RewriteCond %{REQUEST_METHOD} ^TRACE
        RewriteRule .* - [F]
        RewriteCond %{REQUEST_METHOD} ^TRACK
        RewriteRule .* - [F]
        #redirect all port 80 traffic to 443
        RewriteCond %{SERVER_PORT} !^443$
        RewriteRule ^/?(.*) https://www.cryptopp.com/$1 [L,R]
   </IfModule>
</VirtualHost>

<VirtualHost *:443>
    ServerName www.cryptopp.com
    ServerAlias *.cryptopp.com *.cryptopp.* cryptopp.com

    <IfModule mod_headers.c>
        Header set Strict-Transport-Security "max-age=10886400; includeSubDomains"
    </IfModule>
</VirtualHost>

mod_headers

# cat /etc/httpd/conf.modules.d/00-base.conf | grep headers
LoadModule headers_module modules/mod_headers.so

# httpd -t -D DUMP_MODULES | grep header
 headers_module (shared)

error logs

# grep -IR "Strict-Transport-Security" /etc
/etc/httpd/conf/httpd.conf:        Header set Strict-Transport-Security "max-age=10886400; includeSubDomains" env=HTTPS  
# grep -IR "Strict-Transport-Security" /var/log/
# grep -IR "mod_headers" /var/log/
#

.htaccess

# find /var/www -name '.htaccess' -printf '%p\n' -exec cat {} \;
/var/www/html/w/cache/.htaccess
Deny from all
/var/www/html/w/languages/.htaccess
Deny from all
/var/www/html/w/extensions/MobileFrontend/dev-scripts/.htaccess
Deny from all
/var/www/html/w/maintenance/archives/.htaccess
Deny from all
/var/www/html/w/maintenance/.htaccess
Deny from all
/var/www/html/w/serialized/.htaccess
Deny from all
/var/www/html/w/images/temp/.htaccess
# Protect against bug 28235
<IfModule rewrite_module>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} \.[^\\/:*?\x22<>|%]+(#|\?|$) [nocase]
    RewriteRule . - [forbidden]
</IfModule>
/var/www/html/w/images/.htaccess
# Protect against bug 28235
<IfModule rewrite_module>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} \.[^\\/:*?\x22<>|%]+(#|\?|$) [nocase]
    RewriteRule . - [forbidden]
    # Fix for bug T64289
    Options +FollowSymLinks
</IfModule>
/var/www/html/w/images/deleted/.htaccess
Deny from all
/var/www/html/w/includes/.htaccess
Deny from all
/var/www/html/.htaccess
RewriteEngine on
RewriteRule ^wiki/?(.*)$ /w/index.php?title=$1 [L,QSA]
<IfModule mod_deflate.c>
<FilesMatch "\.(js|css|html)$">
SetOutputFilter DEFLATE
</FilesMatch>
</IfModule>

curl transcript

$ /usr/local/bin/curl -Lv cryptopp.com
* Rebuilt URL to: cryptopp.com/
*   Trying 192.210.150.121...
* TCP_NODELAY set
* Connected to cryptopp.com (192.210.150.121) port 80 (#0)
> GET / HTTP/1.1
> Host: cryptopp.com
> User-Agent: curl/7.51.0
> Accept: */*
> 
< HTTP/1.1 302 Found
< Date: Sat, 05 Nov 2016 22:49:25 GMT
< Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips
< Location: https://www.cryptopp.com/
< Content-Length: 209
< Content-Type: text/html; charset=iso-8859-1
< 
* Ignoring the response-body
* Curl_http_done: called premature == 0
* Connection #0 to host cryptopp.com left intact
* Issue another request to this URL: 'https://www.cryptopp.com/'
*   Trying 192.210.150.121...
* TCP_NODELAY set
* Connected to www.cryptopp.com (192.210.150.121) port 443 (#1)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /opt/local/share/curl/curl-ca-bundle.crt
  CApath: none
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: OU=Domain Control Validated; OU=COMODO SSL Unified Communications
*  start date: Sep 17 00:00:00 2015 GMT
*  expire date: Sep 16 23:59:59 2018 GMT
*  subjectAltName: host "www.cryptopp.com" matched cert's "www.cryptopp.com"
*  issuer: C=GB; ST=Greater Manchester; L=Salford; O=COMODO CA Limited; CN=COMODO RSA Domain Validation Secure Server CA
*  SSL certificate verify ok.
> GET / HTTP/1.1
> Host: www.cryptopp.com
> User-Agent: curl/7.51.0
> Accept: */*
> 
< HTTP/1.1 200 OK
< Date: Sat, 05 Nov 2016 22:49:25 GMT
< Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips
< Last-Modified: Wed, 02 Nov 2016 01:27:08 GMT
< ETag: "8988-5404756e12afc"
< Accept-Ranges: bytes
< Content-Length: 35208
< Vary: Accept-Encoding
< Content-Type: text/html; charset=UTF-8
< 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  <title>Crypto++ Library 5.6.5 | Free C++ Class Library of Cryptographic Schemes</title>
  <meta name="description" content=
  "free C++ library for cryptography: includes ciphers, message authentication codes, one-way hash functions, public-key cryptosystems, key agreement schemes, and deflate compression">
  <link rel="stylesheet" type="text/css" href="cryptopp.css">
</head>
...

@MichaelHampton - Yes, several times. I also rebooted the machine. I think we have it figured out... I think it had to do with a bad interaction between Apache, PHP and MediaWiki. Even though the root website is logically disjoint from MediaWiki, there was a bad interaction with a mod_rewrite rule for HTTP → HTTPS. Once we figured out a particular MediWiki problem, HSTS started working as expected. If interested, the MediaWiki problem is documented at [Issue T150115: MediaWiki does not warn or error when wgServer does not match httpd.conf ServerName](https://phabricator.wikimedia.org/T150115) — , Nov 06 '16 at 04:36

score 0 · Answer 1 · answered Feb 14 '17 at 05:03

0

Try Header always set Strict-Transport-Security "max-age=10886400; includeSubdomains"

answered Feb 14 '17 at 05:03

lkp111138

236
1
5

2

Could you write more details from that? – peterh Feb 14 '17 at 06:08

HSTS header not being sent though rule is present and mod_headers is enabled

1 Answers1