Spark-in.me https.
TLDR
HTTPS
https://letsencrypt.org
- Spark-in.me. 1 ?
- Spark-in.me. 2
- Spark-in.me. 3 DIY
- Spark-in.me. 4
- Spark-in.me. 5 HTTPS
- Spark-in.me. 6
- Spark-in.me. 7
, https . , Google 200 , https. , https , , spark-in-me, :
- url;
- / ;
- ( );
- - ( ) ;
- (, , ) , , , ( 1 );
- , , - (nginx) ;
, ,
https . 2017 https , . CA (certification authority), , apache nginx ( ), 1 ( ). :
, , :
$ sudo apt-get install software-properties-common
$ sudo add-apt-repository ppa:certbot/certbot
$ sudo apt-get update
$ sudo apt-get install python-certbot-nginx
$ sudo certbot --nginx
( - ) .
1.
.
2.
( , http, https , ) nginx ( , - , , ). nginx.
, certbot, 2 header, .
# http://nginx.org/en/docs/varindex.html
# https://serverfault.com/questions/638097/passing-ssl-protocol-info-to-backend-via-http-header
# https://serverfault.com/questions/213185/how-to-restart-nginx
# https://serverfault.com/questions/527780/nginx-detect-https-connection-using-a-header
# https://stackoverflow.com/questions/17483641/nginx-to-node-js-pass-params
server {
listen 80;
server_name spark-in.me www.spark-in.me;
root /var/www/spark-in-me/blog;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
proxy_set_header X_SPARK_SSL 0;
}
location ~ /\.(ht|git) {
deny all;
}
}
server {
listen 443 ssl; # managed by Certbot
server_name spark-in.me www.spark-in.me;
ssl_certificate /etc/letsencrypt/live/spark-in.me/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/spark-in.me/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
root /var/www/spark-in-me/blog;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
proxy_set_header X_SPARK_SSL 1;
}
location ~ /\.(ht|git) {
deny all;
}
}
, , , ? . , , SEO ,
3.
( , ). ( ),
/*Protections against CSRF attacks*/
if ("POST" == $_SERVER["REQUEST_METHOD"]) {
if (isset($_SERVER["HTTP_ORIGIN"])) {
$http_origin = $_SERVER['HTTP_ORIGIN'];
$address = "http://".$_SERVER["SERVER_NAME"];
/*
Uncomment the protection bit during deploy
if (strpos($address, $_SERVER["HTTP_ORIGIN"]) !== 0) {
exit("CSRF protection in POST request: detected invalid Origin header: ".$_SERVER["HTTP_ORIGIN"]);
}
*/
} else {
if(!isset($http_origin)) {
$http_origin = '';
}
}
}
/*Headers for modern http-request libraries*/
if (
$http_origin == "http://spark-in.me"
|| $http_origin == "http://api.spark-in.me"
|| $http_origin == "http://admin.spark-in.me"
|| $http_origin == "http://pics.spark-in.me"
|| $http_origin == "http://author.spark-in.me"
|| $http_origin == "https://spark-in.me"
|| $http_origin == "https://api.spark-in.me"
|| $http_origin == "https://admin.spark-in.me"
|| $http_origin == "https://pics.spark-in.me"
|| $http_origin == "https://author.spark-in.me"
|| $http_origin == "http://www.spark-in.me"
|| $http_origin == "http://www.api.spark-in.me"
|| $http_origin == "http://www.admin.spark-in.me"
|| $http_origin == "http://www.pics.spark-in.me"
|| $http_origin == "http://www.author.spark-in.me"
|| $http_origin == "https://www.spark-in.me"
|| $http_origin == "https://www.api.spark-in.me"
|| $http_origin == "https://www.admin.spark-in.me"
|| $http_origin == "https://www.pics.spark-in.me"
|| $http_origin == "https://www.author.spark-in.me"
) {
header("Access-Control-Allow-Origin: $http_origin");
}
else {
// Do nothing
}
header("Access-Control-Allow-Headers: X-Requested-With");
API-endpoint- https. .
4.
, ( , ) https. ( ).
ER ( ):
UPDATE file SET host = replace(host, 'https://pics.spark-in.me/', 'https://pics.spark-in.me/')
(, https, ).
5.
1 2. , - , , . nginx
return 301 https://$server_name$request_uri;
6. Google Search Console
. , , 4 ( www * https). , , . .
https://habrahabr.ru/post/331592/
