3

I am setting up a hobby web site and trying to make it as secure as possible. The backend is nginx + uwsgi. I have set up the HTTPS connection. For non-SSL requests, I have the following rules in nginx.conf:

server {
    listen 80;
    server_name xxx.net;
    return 301 https://xxx.net$request_uri;
}

server {
    listen 80;
    server_name www.xxx.net;
    return 301 https://xxx.net$request_uri;
}

So all http:// requests are 301-redirected to https://. The site is also configured to use HSTS, so browsers will do 306-redirect after the first visit.

In parallel, following some other security-oriented reading, I also set up the UFW firewall to deny access to port 80 (HTTP default). I wonder if that extra step actually adds anything security-wise and doesn't instead introduce confusion?

Will firewall block any HTTP-traffic before nginx has a chance to take over and redirect, or does the redirect happen first? If the redirect does happen, does this rule add anything? Is it a good practice (as an extra security layer) or completely redundant?

2

You can either redirect http (80) to https (443) or block port 80.

You can't do both

redirect http (80) to https (443):

  • Helps users by redirecting them
  • May leak the first request

block port 80:

  • Doesn't leak the first request
  • But the user will not be redirected

Blocking port 80 have a (very little) security advantage, and a huge negative impact in term of usability.

If you really wants to improve security, you should use HSTS and HSTS preload.

See also https://community.letsencrypt.org/t/support-for-https-only-with-http-01-challenge/15134

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.