HTTPS only: HSTS
Every page Zappocity serves over HTTPS, on any host name (the homepage, webmail, the admin panel, signup, and customers' MTA-STS and autoconfig hosts), carries a Strict-Transport-Security header. A browser that has seen it refuses plain HTTP for that host name until the time runs out, so a network attacker cannot strip the connection back to HTTP. It is not sent over plain HTTP, where browsers ignore it.
Settings
In the admin panel, Settings > HTTPS (HSTS), or PATCH /v1/settings:
| Setting | API field | Default | What it does |
|---|---|---|---|
| Remember for | hstsMaxAge | 86400 (one day) | Seconds a browser stays HTTPS-only for the host. 0 tells browsers to forget an earlier policy. At most two years. |
| Subdomains too | hstsIncludeSubdomains | off | Adds includeSubDomains: the policy also covers every name under the host. |
| Preload | hstsPreload | off | Adds preload, which lets you submit the domain to the lists built into browsers. Needs subdomains on and at least 31536000 (a year). |
A change applies to the next response; no restart is needed.
Turning it up safely
- Leave the default one day while you check that every site under your platform domains (for example
mailo.cityandzappo.city) works over HTTPS, including ones served elsewhere, such as a status page or blog. - Raise Remember for to a year (31536000) and turn on Subdomains too. Browsers keep this for a year after their last visit, so an HTTP only subdomain would stay unreachable for that long.
- Only then, if you want it, turn on Preload and submit each apex domain at hstspreload.org. Browsers ship the list, so leaving it takes months.
The header only reaches a browser from a host this server answers for. For an apex domain such as mailo.city to carry it, the apex must point at this server; if another service hosts the apex, set HSTS there too.
www and preloading
hstspreload.org also checks that www. the domain works over HTTPS, because people type it by habit. Zappocity answers www. its own names (the server's host name, the portal host names and the shared domains, such as www.mailo.city) with a certificate and a permanent redirect to the name without www., keeping the path. Point www at this server (an A and AAAA record, or a CNAME) and it works on the first visit.
Before submitting a domain such as mailo.city:
- The apex and
wwwpoint at this server and open over HTTPS. - Every other name under the domain that serves web pages works over HTTPS, because
includeSubDomainsmakes browsers refuse plain HTTP everywhere under it. Mail names (MX, IMAP, SMTP) are not affected. Set the policy in one change:
sudo corpsuite settings set hstsMaxAge:=31536000 hstsIncludeSubdomains:=true hstsPreload:=true- Check the header with
curl -sI https://mailo.city/ | grep -i strict, then submit at hstspreload.org.