☰

Nginx 重定向到 www

tag-icon • tag-icon nginx redirect hsts
Nginx 重定向到 www

我的所有块都具有相同的配置，但只有这一个重定向到 www，而我所有其他块都重定向到非 www。我认为这可能与我最近添加的 hsts 有关，但我不确定，因为就像我说的那样，其他块具有相同的配置，这是配置文件：

server {

        root /var/www/mydomain;
        index index.php index.html index.htm index.nginx-debian.html;

        server_name mydomain.es www.mydomain.es;


        location / {
                #try_files $uri $uri/ =404;
                try_files $uri $uri/ /index.php$is_args$args;
        }

        location ~ \.php$ {
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
        }

        location ~* \.(css|gif|ico|jpeg|jpg|js|png)$ {
                expires max;
                log_not_found off;
        }

                location = /favicon.ico { log_not_found off; access_log off; }
                location = /robots.txt { log_not_found off; access_log off; allow all; }
                location ~* \.(css|gif|ico|jpeg|jpg|js|png|svg|woff)$ {
                expires 2d;
                add_header Cache-Control "public, no-transform";
        }

                location ~* \.(jpg|jpeg|gif|png|svg|woff)$ {
                        expires 365d;
        }

                location ~* \.(pdf|css|html|js|swf)$ {
                        expires 2d;
        }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/mydomain.es/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/mydomain.es/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

}

server {
    if ($host = www.mydomain.es) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    if ($host = mydomain.es) {
        return 301 https://$host$request_uri;
    } # managed by Certbot



        server_name mydomain.es www.mydomain.es;
    listen 80;
    return 404; # managed by Certbot
}

我究竟做错了什么？

答案1

您的两个块都监听相同域的相同端口 - 请注意您的 listen 和 server_name 语句。您还使用了不是最佳的 if 语句。接受 www 或非 www 上的访问者也很奇怪，大多数网站都会选择其中一个并重定向到该站点。

这是重定向到 www 网站的标准模式，包括我使用的安全标头

# Main server block serving content
server {
  server_name example.com;

  listen 443 ssl http2;

  ssl_certificate /var/lib/acme/certs/***CERT_DIRECTORY/fullchain;
  ssl_certificate_key /var/lib/acme/certs/***CERT_DIRECTORY/privkey;

  # Set up preferred protocols and ciphers. TLS1.2 is required for HTTP/2
  # Generate at https://cipherli.st/
  # NB: I had to comment out session tockets, stapling, and resolver to get this to work, but I didn't try very hard.
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
  ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
  ssl_session_cache shared:SSL:10m;
  ssl_session_tickets off; # Requires nginx >= 1.5.9
  ssl_stapling on; # Requires nginx >= 1.3.7
  ssl_stapling_verify on; # Requires nginx => 1.3.7
  resolver ****** $DNS-IP-1 $DNS-IP-2 valid=300s;
  resolver_timeout 5s;
  add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
  add_header X-Frame-Options DENY;
  add_header X-Content-Type-Options nosniff;

  etc
}

# This server simply redirects the requested to the https version of the page
server {
  listen 80;
  server_name www.example.com example.com;

  location /.well-known/acme-challenge/ {
    alias /var/www/.well-known/acme-challenge/;
  }

  location / {
    return 301 https://www.example.com$request_uri;
  }
}

server {
  listen 443 ssl http2;
  server_name www.example.com;

  ssl_certificate /var/lib/acme/certs/***CERT_DIRECTORY/fullchain;
  ssl_certificate_key /var/lib/acme/certs/***CERT_DIRECTORY/privkey;

  # Set up preferred protocols and ciphers. TLS1.2 is required for HTTP/2
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
  ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0

  access_log  /var/log/nginx/access.log main buffer=32k flush=1m if=$log_ua;

  return 301 https://www.example.com$request_uri;
}

相关内容