From 3f669e68bbeb798da18a397601915c98a557d604 Mon Sep 17 00:00:00 2001 From: Wouter Kobes Date: Wed, 15 Jul 2026 14:16:14 +0200 Subject: [PATCH] Fixed internetstandards/toolbox-wiki#23 --- example-configs/Webserver-100%-example-configs.md | 1 + 1 file changed, 1 insertion(+) diff --git a/example-configs/Webserver-100%-example-configs.md b/example-configs/Webserver-100%-example-configs.md index 2f913e9..13f385d 100644 --- a/example-configs/Webserver-100%-example-configs.md +++ b/example-configs/Webserver-100%-example-configs.md @@ -8,6 +8,7 @@ For all webservers, we observe the following common mistakes: * HTTPS redirect: our test demands an upgrade to HTTPS **first**, before redirecting. This means that when you want your website to be accessible over domain example.nl, we expect http://example.nl to redirect to https://example.nl, while http://www.example.nl should redirect first to https://www.example.nl, then to https://example.nl. The reason for this, is that HSTS will only work when the Strict-Transport-Security header is served over HTTPS. By redirecting directly, the initial domain is not protected by HSTS. * SHA-1 as hash function for key exchange: this is a legacy hash function that is explicitly deprecated since 2021 by [RFC 9155](https://datatracker.ietf.org/doc/html/rfc9155) and insufficient according to the latest TLS guidelines. Note that this is a different setting than the accepted ciphers. Not all firmware (especially GUI firmware) allows you easily change this configuration. +* Internet.nl expects HTTP security headers to be set, even when a domain/URL is merely a redirect to another domain. This is considered a defense-in-depth measure and should not affect the redirect. ## nginx The most actual example configuration can be found within the source code of Internet.nl itself.