From 6e204c6e7b6d4c010b2702e4e4b6f0d8cea7d702 Mon Sep 17 00:00:00 2001 From: Kirk Larkin <6025110+serpent5@users.noreply.github.com> Date: Wed, 17 Jun 2020 23:13:58 +0100 Subject: [PATCH] Clarify OR when describing HSTS for Linux+nginx (#18836) --- aspnetcore/host-and-deploy/linux-nginx.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/aspnetcore/host-and-deploy/linux-nginx.md b/aspnetcore/host-and-deploy/linux-nginx.md index 0374eec4f8..fae8fffeb1 100644 --- a/aspnetcore/host-and-deploy/linux-nginx.md +++ b/aspnetcore/host-and-deploy/linux-nginx.md @@ -369,7 +369,10 @@ Configure the app to use a certificate in development for the `dotnet run` comma * Adding an `HTTP Strict-Transport-Security` (HSTS) header ensures all subsequent requests made by the client are over HTTPS. -* Don't add the HSTS header or chose an appropriate `max-age` if HTTPS will be disabled in the future. +* If HTTPS will be disabled in the future, use one of the following approaches: + + * Don't add the HSTS header. + * Choose a short `max-age` value. Add the */etc/nginx/proxy.conf* configuration file: