enforcing HSTS with EZproxy

"Hosburgh, Nathan (NIH/OD/ORS) [E]" <[email protected]> Thu, 9 Jan 2020 14:25:20 +0000
Newsgroups	gmane.education.ezproxy
Message-ID	<MN2PR09MB5196BF4798C8CEAF418E1459E9390@MN2PR09MB5196.namprd09.prod.outlook.com>
--_000_MN2PR09MB5196BF4798C8CEAF418E1459E9390MN2PR09MB5196namp_
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=utf-8

Based on the release notes for v6.6.2<https://help.oclc.org/Library_Manageme=
nt/EZproxy/EZproxy_release_notes_and_known_issues/2019_release_notes/050EZpr=
oxy_v6_6_2_release_notes>, it appears that enforcing HSTS is an option (I'm =
guessing it was on previous versions as well), however I cannot find any add=
itional documentation on its application and use with EZproxy.

I'm aware of the Option ForceHTTPSLogin but this only ensures users initiall=
y access a secure login page for EZproxy, not that each site in the session =
must be https.

Is anyone enforcing HSTS and, if so, how have you defined in your configurat=
ion (syntax, options, etc)?

Thanks
Nate

Nathan Hosburgh, MLIS, MSCIS
Lead, Library Systems Office
Senior Technical Information Specialist
National Institutes of Health Library
Office of Research Services
Division of Library Services
Building 10, Room 1L07
Bethesda, MD 20892-1150
Office: 301.827.3825
Cell: 301.605.0189
eFax: 301-480-4948
[email protected]<mailto:[email protected]>





********************************************************************
If you wish to stop receiving messages from EZPROXY-L or otherwise amend you=
r preferences,
you can do so <a href=3D"https://www.oclc.org/forms/internet-subscription.en=
.html">here</a>.
Or email [email protected] including the relevant text below in the bod=
y of the email:
=E2=80=A2 To unsubscribe: "unsubscribe EZPROXY-L"
=E2=80=A2 To receive EZPROXY-L in digest form: "set EZPROXY-L digest"
=E2=80=A2 To set your options to no mail: "set EZPROXY-L nomail"
=E2=80=A2 To receive these messages in the future "set EZPROXY-L mail"
To contact the list owners directly please send your message to EZPROXY-L-re=
[email protected].
If you unsubscribe from EZPROXY-L, you will no longer be able to participate=
 in any of its features, including the public forum.
To unsubscribe from all OCLC marketing email communications
(including all OCLC listervs, OCLC Connect emails, OCLC event notifications,=
 product/service/cooperative updates and newsletters),
please email us at [email protected].
--_000_MN2PR09MB5196BF4798C8CEAF418E1459E9390MN2PR09MB5196namp_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif;}
h1
	{mso-style-priority:9;
	mso-style-link:"Heading 1 Char";
	margin-top:12.0pt;
	margin-right:0in;
	margin-bottom:0in;
	margin-left:0in;
	margin-bottom:.0001pt;
	page-break-after:avoid;
	font-size:16.0pt;
	font-family:"Calibri Light",sans-serif;
	color:#2F5496;
	font-weight:normal;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:#0563C1;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:#954F72;
	text-decoration:underline;}
span.EmailStyle17
	{mso-style-type:personal-compose;
	font-family:"Calibri",sans-serif;
	color:windowtext;}
span.Heading1Char
	{mso-style-name:"Heading 1 Char";
	mso-style-priority:9;
	mso-style-link:"Heading 1";
	font-family:"Calibri Light",sans-serif;
	color:#2F5496;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-family:"Calibri",sans-serif;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72">
<div class=3D"WordSection1">
<p class=3D"MsoNormal">Based on the <a href=3D"https://help.oclc.org/Librar=
y_Management/EZproxy/EZproxy_release_notes_and_known_issues/2019_release_no=
tes/050EZproxy_v6_6_2_release_notes">
release notes for v6.6.2</a>, it appears that enforcing HSTS is an option (=
I&#8217;m guessing it was on previous versions as well), however I cannot f=
ind any additional documentation on its application and use with EZproxy.
<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">I&#8217;m aware of the <b>Option ForceHTTPSLogin </b=
>but this only ensures users initially access a secure login page for EZpro=
xy, not that each site in the session must be https.<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">Is anyone enforcing HSTS and, if so, how have you de=
fined in your configuration (syntax, options, etc)?<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">Thanks<o:p></o:p></p>
<p class=3D"MsoNormal">Nate<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal"><span style=3D"font-size:9.0pt;color:gray">Nathan Ho=
sburgh, MLIS, MSCIS<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:9.0pt;color:gray">Lead, Lib=
rary Systems Office<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:9.0pt;color:gray">Senior Te=
chnical Information Specialist<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:9.0pt;color:gray">National =
Institutes of Health Library<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:9.0pt;color:gray">Office of=
 Research Services<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:9.0pt;color:gray">Division =
of Library Services<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:9.0pt;color:gray">Building =
10, Room 1L07<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:9.0pt;color:gray">Bethesda,=
 MD 20892-1150<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:9.0pt;color:gray">Office: 3=
01.827.3825<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:9.0pt;color:gray">Cell: 301=
.605.0189<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:9.0pt;color:gray">eFax: 301=
-480-4948<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:9.0pt;color:gray"><a href=
=3D"mailto:[email protected]"><span style=3D"color:gray">Nathan.Hosbu=
[email protected]</span></a><o:p></o:p></span></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
</div>
</body>
</html>
<br>
<hr>
<p align=3D"center">To unsubscribe from the EZPROXY-L list, click the following link:<br>
<a href=3D"http://listserv.oclclists.org/scripts/wa.exe?SUBED1=3DEZPROXY-L&A=3D1" target=3D"_blank">http://listserv.oclclists.org/scripts/wa.exe?SUBED1=3DEZPROXY-L&A=3D1</a>
</p>

--_000_MN2PR09MB5196BF4798C8CEAF418E1459E9390MN2PR09MB5196namp_--