Removing HSTS/STS from NGINX Headers

[StarScream159]

Hello everyone.

Is it possible to edit/remove the NGINX configuration from sending the HSTS/STS headers with page requests:

Code:

strict-transport-security:max-age=31536000

I connect to my NAS from a generic Dynamic DNS address (like from dynu.com, changeip.com, namecheap, etc.). But I also use the same address to access other services running on my home network on different ports. However, these other services aren't running under HTTPS. So if I browse to my FreeNAS GUI, then I attempt to use a service that isn't HTTPS, the browser is remembering the HSTS/STS setting and forcing a HTTPS redirect on the service/port that isn't HTTPS.

I'll give an example:

PORT 80 - FreeNAS (HTTP)
PORT 443 - FreeNAS (HTTPS)
PORT 4040 - Subsonic (HTTP)
PORT 8000 - pyLoad (HTTPS)
etc.

So first if I browse to Subsonic on port 4040 with plain HTTP, everything works great. Then later in the day/whenever I browse to FreeNAS (on either http or https) it'll then set the HSTS/STS browser setting. Then browsing back to my Subsonic service won't work, as it will now redirect to HTTPS. pyLoad, as an example, on the other hand always works, because it wants HTTPS, so it doesn't matter.

I've tried to change the settings in FreeNAS GUI to no avail. No combination of forcing/not forcing redirect to HTTPS, or enabling both HTTP+HTTPS works. As long as HTTPS is enabled in some fashion, it seems, the HSTS/STS header is sent.

If there is no easy way to remove the headering from NGINX, I can look into whitelisting/disabling HSTS/STS for my domain.

Thanks for reading.

 

[dlavigne]

Which build version of FreeNAS (from System -> Information)? And do all browsers do this (eg is there a browser that lets you configure this)?

 

[StarScream159]

Hi dlavigne,

Thanks for the reply.

My version is: FreeNAS-9.3-STABLE-201504100216

Currently all major browsers support HSTS/STS, as outline by the "caniuse" matrix on this page: http://caniuse.com/stricttransportsecurity

Which browser I use has no effect on the settings changes. The HSTS header is always sent with each request, as long as HTTPS is enabled in any fashion.

Some browsers, such as Chrome for example, offer an easy way to view/edit the HSTS/STS information that has been cached for a domain. Which is my temporary solution: I just go to chrome://net-internals/#hsts and search for the domain and remove/delete it.

 

[dlavigne]

That is probably the best solution as it is an edge case.

 

[RichieB]

I just got bitten by this bug. I also have other HTTP services running on different ports. Because of the HSTS headers that FreeNAS sends I cannot use the other services. What's worse, Safari 10 no longer allows editing of HSTS.plist, it will just recreate it. Sending HSTS headers should really not be the default for the FreeNAS admin interface.

 

[dlavigne]

Please create a feature request at bugs.freenas.org and post the issue number here.

 

[RichieB]

You mean like this one filed a month ago? https://bugs.freenas.org/issues/20652