HTTPS-only and HSTS - Revision history

Libjlrs: /* Add the HSTS header */

2021-05-21T11:06:32Z

‎Add the HSTS header

Libjlrs: /* Changes to archive's cfg/lang/LANGID/templates/default.xml, and /cfg/lang/LANGID/static/.XPAGE files /

2021-05-21T11:04:32Z

‎Changes to archive's cfg/lang/LANGID/templates/default.xml, and /cfg/lang/LANGID/static/*.XPAGE files

Libjlrs: /* Changes to archive's cfg/lang/LANGID/templates/default.xml, and /cfg/lang/LANGID/static/.XPAGE files /

2021-05-21T11:04:07Z

‎Changes to archive's cfg/lang/LANGID/templates/default.xml, and /cfg/lang/LANGID/static/*.XPAGE files

Drn@ecs.soton.ac.uk: /* Add 301 redirects to secure port from HTTP (port 80) */

2018-02-21T01:36:22Z

‎Add 301 redirects to secure port from HTTP (port 80)

Drn@ecs.soton.ac.uk at 01:35, 21 February 2018

2018-02-21T01:35:34Z

Drn@ecs.soton.ac.uk: Changed to suggesting using securevhost.conf

2018-02-21T01:23:15Z

Changed to suggesting using securevhost.conf

Drn@ecs.soton.ac.uk at 01:14, 21 February 2018

2018-02-21T01:14:06Z

Drn@ecs.soton.ac.uk at 17:59, 20 February 2018

2018-02-20T17:59:27Z

Drn@ecs.soton.ac.uk: Further tweaks regarding 301 redirects.

2018-02-20T17:38:24Z

Further tweaks regarding 301 redirects.

Drn@ecs.soton.ac.uk: gave bit more info on what to do after patching.

2018-02-20T17:27:53Z

gave bit more info on what to do after patching.

@@ Line 49: / Line 49: @@
 Edit [[Template:Securevhost.conf|EPRINTS_PATH/archives/REPOID/ssl/securevhost.conf]] and add the following HSTS header after ther <tt>ServerName</tt> line.  The max-age variable is a time in seconds for how long the HSTS settings should be remembered by the browser.  15780000 is six months, which is a long time, you may want to set it to a shorter time while testing.
   Header set Strict-Transport-Security "max-age=15780000"
 Include this file from the core apache conf file for the secure port (443) in <tt>/etc/</tt>

@@ Line 40: / Line 40: @@
 === Changes to archive's <tt>cfg/lang/LANGID/templates/default.xml</tt>, and <tt>/cfg/lang/LANGID/static/*.XPAGE</tt> files ===
-Remove any hard coded links to HTTP
+* Remove any hard coded links to HTTP
-If you have Google Search included as an XPAGE file,
+* If you have Google Search included as an XPAGE file, call on the Google API (and any other APIs) using HTTPS.
 === Changes to Apache config files ===

@@ Line 40: / Line 40: @@
 === Changes to archive's <tt>cfg/lang/LANGID/templates/default.xml</tt>, and <tt>/cfg/lang/LANGID/static/*.XPAGE</tt> files ===
- Remove any hard coded links to HTTP
+Remove any hard coded links to HTTP
- If you have Google Search included as an XPAGE file,
+If you have Google Search included as an XPAGE file,
- call on the Google API (and any other APIs) using HTTPS.
+call on the Google API (and any other APIs) using HTTPS.
 === Changes to Apache config files ===

@@ Line 56: / Line 56: @@
 ==== Add 301 redirects to secure port from HTTP (port 80) ====
-By making the changes to the archive's <tt>cfg.d/10_core.pl</tt>, if you use [https://github.com/eprints/eprints/commit/c29574dbdcd49c67f3aea522998960f2eb19f544 this patch] or are running [https://github.com/eprints/eprints the latest revision of EPrints on GitHub], <tt>/bin/generate_apacheconf</tt> will generate an <tt>/cfg/apache/REPOID.conf</tt>, which automatically redirects HTTP to HTTPS.  Otherwise, this can be achieved by modifying <tt>/cfg/apache/REPOID.conf</tt> to the following, substituting your domain as appropriate:
+By making the above changes to the archive's <tt>cfg.d/10_core.pl</tt>, if you use [https://github.com/eprints/eprints/commit/c29574dbdcd49c67f3aea522998960f2eb19f544 this patch] or are running [https://github.com/eprints/eprints the latest revision of EPrints on GitHub], <tt>/bin/generate_apacheconf</tt> will generate an <tt>/cfg/apache/REPOID.conf</tt>, which automatically redirects HTTP to HTTPS.  Otherwise, this can be achieved by modifying <tt>/cfg/apache/REPOID.conf</tt> to the following, substituting your domain as appropriate:
 <source lang="xml">

@@ Line 27: / Line 27: @@
 == Implementing HTTPS-only with HSTS on an EPrints repository ==
-=== Changes to /cfg.d/10_core.pl ===
+=== Changes to archive's cfg.d/10_core.pl ===
 Initialize the following variables to be the https URL (i.e., https://<nowiki>YOUR-REPOSITORY-DOMAIN</nowiki>)
@@ Line 38: / Line 38: @@
 </source>
-=== Changes to <tt>/cfg/lang/LANGID/templates/default.xml</tt>, and <tt>/cfg/lang/LANGID/static/*.XPAGE</tt> files ===
+=== Changes to archive's <tt>cfg/lang/LANGID/templates/default.xml</tt>, and <tt>/cfg/lang/LANGID/static/*.XPAGE</tt> files ===
   Remove any hard coded links to HTTP
@@ Line 48: / Line 48: @@
 ==== Add the HSTS header ====
-Edit [[Template:Securevhost.conf|EPRINTS_PATH/archives/REPOID/ssl/securevhost.conf]] and add the following HSTS header.  The max-age variable is a time in seconds for how long the HSTS settings should be remembered by the browser.  15780000 is six months, which is a long time, you may want to set it to a shorter time while testing.
+Edit [[Template:Securevhost.conf|EPRINTS_PATH/archives/REPOID/ssl/securevhost.conf]] and add the following HSTS header after ther <tt>ServerName</tt> line.  The max-age variable is a time in seconds for how long the HSTS settings should be remembered by the browser.  15780000 is six months, which is a long time, you may want to set it to a shorter time while testing.
   Header set Strict-Transport-Security "max-age=15780000"
@@ Line 56: / Line 56: @@
 ==== Add 301 redirects to secure port from HTTP (port 80) ====
-By following the instructions above, if you use [https://github.com/eprints/eprints/commit/c29574dbdcd49c67f3aea522998960f2eb19f544 this patch] or are running [https://github.com/eprints/eprints the latest revision of EPrints on GitHub], <tt>/bin/generate_apacheconf</tt> will generate an <tt>/cfg/apache/REPOID.conf</tt>, which automatically redirects HTTP to HTTPS.  Otherwise, this can be achieved by modifying <tt>/cfg/apache/REPOID.conf</tt> to the following, substituting your domain as appropriate:
+By making the changes to the archive's <tt>cfg.d/10_core.pl</tt>, if you use [https://github.com/eprints/eprints/commit/c29574dbdcd49c67f3aea522998960f2eb19f544 this patch] or are running [https://github.com/eprints/eprints the latest revision of EPrints on GitHub], <tt>/bin/generate_apacheconf</tt> will generate an <tt>/cfg/apache/REPOID.conf</tt>, which automatically redirects HTTP to HTTPS.  Otherwise, this can be achieved by modifying <tt>/cfg/apache/REPOID.conf</tt> to the following, substituting your domain as appropriate:
 <source lang="xml">

← Older revision		Revision as of 01:14, 21 February 2018
Line 1:		Line 1:
		+	{{manual}}
		+
	[[Category:Authentication]]		[[Category:Authentication]]

← Older revision		Revision as of 17:27, 20 February 2018
Line 66:		Line 66:
	</source>		</source>

−	To save having to ensure your modify <tt>/cfg/apache/REPOID.conf</tt> any time <tt>/bin/generate_apacheconf</tt> [https://github.com/eprints/eprints/commit/c29574dbdcd49c67f3aea522998960f2eb19f544 this patch] can be applied to <tt>perl_lib/EPrints/Apache.pm</tt>	+	To save having to ensure your modify <tt>/cfg/apache/REPOID.conf</tt> any time <tt>/bin/generate_apacheconf</tt> is run, [https://github.com/eprints/eprints/commit/c29574dbdcd49c67f3aea522998960f2eb19f544 this patch] can be applied to <tt>perl_lib/EPrints/Apache.pm</tt>. At which point you can run <tt>/bin/generate_apacheconf</tt> to generate the appropriate <tt>/cfg/apache/REPOID.conf</tt> configuration.

HTTPS-only and HSTS - Revision history

Libjlrs: /* Add the HSTS header */

Libjlrs: /* Changes to archive's cfg/lang/LANGID/templates/default.xml, and /cfg/lang/LANGID/static/*.XPAGE files */

Libjlrs: /* Changes to archive's cfg/lang/LANGID/templates/default.xml, and /cfg/lang/LANGID/static/*.XPAGE files */

Drn@ecs.soton.ac.uk: /* Add 301 redirects to secure port from HTTP (port 80) */

Drn@ecs.soton.ac.uk at 01:35, 21 February 2018

Drn@ecs.soton.ac.uk: Changed to suggesting using securevhost.conf

Drn@ecs.soton.ac.uk at 01:14, 21 February 2018

Drn@ecs.soton.ac.uk at 17:59, 20 February 2018

Drn@ecs.soton.ac.uk: Further tweaks regarding 301 redirects.

Drn@ecs.soton.ac.uk: gave bit more info on what to do after patching.

Libjlrs: /* Changes to archive's cfg/lang/LANGID/templates/default.xml, and /cfg/lang/LANGID/static/.XPAGE files /

Libjlrs: /* Changes to archive's cfg/lang/LANGID/templates/default.xml, and /cfg/lang/LANGID/static/.XPAGE files /