After upgrading from Nextcloud 29 to Nextcloud 30, I’ve realised that I’m now getting the HTTP Strict Transport alert, even if I wasn’t getting it before and everything seems to working fine.
I have the following in my .conf
<VirtualHost *:443>
ServerName <myhost>.com
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"
</IfModule>
</VirtualHost>
This is what curl -I -L https://<myhost>/
shows:
HTTP/2 302
content-security-policy: default-src ‘self’; script-src ‘self’ ‘nonce-isJAwWo9bR00Lp1hlrf5ADgQAKLP6dOiMWsjAmVnO6k=’; style-src ‘self’ ‘unsafe-inline’; frame-src *; img-src * data: blob:; font-src ‘self’ data:; media-src *; connect-src *; object-src ‘none’; base-uri ‘self’;
set-cookie: oc_sessionPassphrase=NjFUnF3nj0wS4t3XBZ9NM9yreilG6biF4GZdjb0f4k1AOC5MNaqxn4PixqaJlaNGp%2FGsiTEOH%2B4Az0oxO7%2FheoPXU%2BWVuYf%2FJcGV84F6eWTAWAkC17Fx5O1SEM9w%2Be63; path=/; secure; HttpOnly; SameSite=Lax
set-cookie: __Host-nc_sameSiteCookielax=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax
set-cookie: __Host-nc_sameSiteCookiestrict=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict
set-cookie: ocp1egv7aces=cagq1b3ocer07bl2lgjlnbu56e; path=/; secure; HttpOnly; SameSite=Lax
strict-transport-security: max-age=15552000; includeSubDomains
referrer-policy: no-referrer
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-robots-tag: noindex, nofollow
x-xss-protection: 1; mode=block
Any idea why that is happening?