cis-nginx-v300-4-1-8

name	cis-nginx-v300-4-1-8
description	Ensure HTTP Strict Transport Security (HSTS) is enabled (Manual)
category	cis-nginx
version	3.0
author	cyberstrike-official
tags	["cis","nginx","web-server","reverse-proxy","tls-ssl","encryption"]
cis_id	4.1.8
cis_benchmark	CIS NGINX Benchmark v3.0.0
tech_stack	["nginx","linux","web-server"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS 4.1.8 — Ensure HTTP Strict Transport Security (HSTS) is enabled

Profile Applicability

• Level 1 - Webserver
• Level 1 - Proxy
• Level 1 - Loadbalancer

Description

HTTP Strict Transport Security (HSTS) is a critical security header that instructs browsers to communicate with a domain exclusively over HTTPS. A comprehensive HSTS policy must include the includeSubDomains directive to apply the policy to all current and future subdomains. For maximum protection, the policy should also contain the preload directive, allowing the domain to be submitted to browser-pre-load lists. This ensures that even the very first connection to the domain is made securely. The max-age should be set to a long duration, typically two years (63072000 seconds), to ensure browsers enforce this policy persistently.

Rationale

HSTS is the primary mechanism to mitigate protocol downgrade attacks and cookie hijacking. By enforcing HTTPS, it prevents attackers from intercepting requests and manipulating them. The includeSubDomains directive is vital as it closes a significant gap where an attacker could otherwise target a non-secure subdomain. The preload directive provides protection by removing the initial window of opportunity for an attack on a user's first visit, as the browser already knows to use HTTPS before making any connection.

Impact

Once an HSTS policy with a long max-age is set, there is effectively "no going back." If any part of your site or any subdomain cannot be served over HTTPS, users with a cached HSTS policy will be unable to access it. Enabling includeSubDomains requires a commitment that all subdomains of the domain will support HTTPS. Submitting a domain to the HSTS preload list is a long-term commitment and removal is a slow, manual process. Careful planning and testing with short max-age values are essential before full deployment.

Audit Procedure

Run the following command to inspect the fully loaded NGINX configuration for the Strict-Transport-Security header:

nginx -T 2>/dev/null | grep -i 'Strict-Transport-Security'

Verify that the output includes a header with the following components:

• A max-age directive of at least 31536000 (one year), with 63072000 (two years) being the recommended value.
• The includeSubDomains directive.