0

We have an Apache 2.4 server that runs numerous virtual hosts, some of which use http and some of which use https. I would like to send the same HSTS (Strict-Transport-Security) header only in those virtual hosts that use https.

I realize I could add the Header command individually to each virtual hosts, but I would rather set it once in the Apache global config section. Is it possible to set it in the global config so that only the https virtual hosts send it?

user35042
  • 2,681
  • 12
  • 34
  • 60

1 Answers1

1

You can try to use a if expression.

http://httpd.apache.org/docs/2.4/mod/core.html#if

http://httpd.apache.org/docs/2.4/expr.html

For example, untested

# Check a HTTP header for a list of values <If "%{HTTPS} == 'on' && %{HTTP_HOST} == 'ssl.example.com'"> Header set HSTS ... </If>

Aleksandar
  • 281
  • 1
  • 5