Protecting web site with nginx 301 redirect and HTTP firewall

Question

I am setting up a hobby web site and trying to make it as secure as possible. The backend is nginx + uwsgi. I have set up the HTTPS connection. For non-SSL requests, I have the following rules in nginx.conf:

server {
    listen 80;
    server_name xxx.net;
    return 301 https://xxx.net$request_uri;
}

server {
    listen 80;
    server_name www.xxx.net;
    return 301 https://xxx.net$request_uri;
}

So all http:// requests are 301-redirected to https://. The site is also configured to use HSTS, so browsers will do 306-redirect after the first visit.

In parallel, following some other security-oriented reading, I also set up the UFW firewall to deny access to port 80 (HTTP default). I wonder if that extra step actually adds anything security-wise and doesn't instead introduce confusion?

Will firewall block any HTTP-traffic before nginx has a chance to take over and redirect, or does the redirect happen first? If the redirect does happen, does this rule add anything? Is it a good practice (as an extra security layer) or completely redundant?

Answer 1

You can either redirect http (80) to https (443) or block port 80.

You can't do both

redirect http (80) to https (443):

• Helps users by redirecting them
• May leak the first request

block port 80:

• Doesn't leak the first request
• But the user will not be redirected

Blocking port 80 have a (very little) security advantage, and a huge negative impact in term of usability.

If you really wants to improve security, you should use HSTS and HSTS preload.

See also https://community.letsencrypt.org/t/support-for-https-only-with-http-01-challenge/15134