Skip to main content

HTTP Strict Transport Security (HSTS) in Nexus Repository 3

Updated

What is HTTP Strict Transport Security (HSTS)?

HSTS is a standard intended to encourage web browsers to only transmit requests securely using https to a given host name. This feature can prevent accidental transmission of sensitive data to a plain http endpoint at the same host name by web browsers which support it.

Build tools do not typically support HSTS, however they will not break either if the server sends indication that the server supports it.

How to Enable HSTS in Nexus Repository 3

When TLS connections are terminated by Nexus Repository 3 directly through Eclipse Jetty configuration, HSTS is already enabled by default. The settings are specified inside jetty-https.xml.

If you are terminating HTTPS connections to Nexus Repository using a reverse proxy, you must configure your reverse proxy to enable or disable HSTS. Instructions for doing that are beyond the scope of this article. 

How to Disable HSTS in Nexus Repository 3

  1. Edit nexus.properties
  2. Add a line containing 
    jetty.https.stsMaxAge=-1
  3. Save the file and restart Nexus Repository.

 

Related articles