[Kimchi-devel] [PATCH] security: Redirect all HTTP requests to HTTPS

[Aline Manera]

From: Aline Manera <alinefm at br.ibm.com>

Improve kimchi security by redirecting all HTTP requests to HTTPS that
way we make sure all information will be send in a secure way to and
from the server.

Also add Strict-Transport-Security header to avoid SSL stripping
(https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping)

Signed-off-by: Aline Manera <alinefm at br.ibm.com>
---
 src/nginx.conf.in |   16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/src/nginx.conf.in b/src/nginx.conf.in
index 967b46b..9218032 100644
--- a/src/nginx.conf.in
+++ b/src/nginx.conf.in
@@ -17,7 +17,6 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 # 02110-1301  USA
 
-
 # This is a template file to be used to generate a nginx
 # proxy config file at kimchid script.
 
@@ -30,7 +29,6 @@ events {
     worker_connections  1024;
 }
 
-
 http {
 
     log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
@@ -38,18 +36,26 @@ http {
                       '"$http_user_agent" "$http_x_forwarded_for"';
 
     access_log  /var/log/nginx/access.log  main;
-
-    sendfile        on;
+    sendfile    on;
 
     server {
-        listen       $proxy_port;
         listen $proxy_ssl_port ssl;
+
         ssl_certificate $cert_pem;
         ssl_certificate_key $cert_key;
 
+        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
+
         location / {
             proxy_pass http://localhost:$kimchid_port;
             proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         }
     }
+
+    server {
+        listen $proxy_port;
+        rewrite ^/(.*)$ https://$host:$proxy_ssl_port/$1 redirect;
+    }
 }
-- 
1.7.10.4