# Send Strict-Transport-Security header in 401 response

**URL:** <https://www.ruby-forum.com/t/send-strict-transport-security-header-in-401-response/244815>\
**Category:** NGINX\
**Created:** [June 19, 2016, 11:52am UTC](https://www.ruby-forum.com/t/send-strict-transport-security-header-in-401-response/244815 "2016-06-19T11:52:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\
**Post date:** [June 19, 2016, 11:52am UTC](https://www.ruby-forum.com/t/send-strict-transport-security-header-in-401-response/244815/1 "2016-06-19T11:52:03Z")

</div>

Hello,  
I would like to send the header:

add\_header Strict-Transport-Security “max-age=31536000;  
includeSubDomains”;

Despite the 401 Unauthorized request. Is that possible?

Currently the header is only added after a successful authorization:

(x1) [~] curl -v [https://tuvl.de](https://tuvl.de)

- Rebuilt URL to: [https://tuvl.de/](https://tuvl.de/)
- Hostname was NOT found in DNS cache
- Trying 2a01:4f8:b0:2fff::2…
- Connected to [tuvl.de](http://tuvl.de) (2a01:4f8:b0:2fff::2) port 443 (#0)
- successfully set certificate verify locations:
- CAfile: none  
CApath: /etc/ssl/certs
- SSLv3, TLS handshake, Client hello (1):
- SSLv3, TLS handshake, Server hello (2):
- SSLv3, TLS handshake, CERT (11):
- SSLv3, TLS handshake, Server key exchange (12):
- SSLv3, TLS handshake, Server finished (14):
- SSLv3, TLS handshake, Client key exchange (16):
- SSLv3, TLS change cipher, Client hello (1):
- SSLv3, TLS handshake, Finished (20):
- SSLv3, TLS change cipher, Client hello (1):
- SSLv3, TLS handshake, Finished (20):
- SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
- Server certificate:
- 

```
   subject: CN=tuvl.de

```

- 

```
   start date: 2016-06-19 08:39:00 GMT

```

- 

```
   expire date: 2016-09-17 08:39:00 GMT

```

- 

```
   subjectAltName: tuvl.de matched

```

- 

```
   issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3

```

- 

```
   SSL certificate verify ok.

```

> GET / HTTP/1.1  
> User-Agent: curl/7.38.0  
> Host: [tuvl.de](http://tuvl.de)  
> Accept: _/_

\< HTTP/1.1 401 Unauthorized

- Server nginx is not blacklisted  
\< Server: nginx  
\< Date: Sun, 19 Jun 2016 09:47:40 GMT  
\< Content-Type: text/html  
\< Content-Length: 188  
\< Connection: keep-alive  
\< WWW-Authenticate: Basic realm=“Virtual Lab”  
\<

401 Authorization Required
# 401 Authorization Required

* * *
nginx \* Connection #0 to host tuvl.de left intact

Cheers,  
Thomas

---

<div class="post-metadata">

**Author:** ![hildegunst](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/4bbf92/32.png) [@hildegunst](https://www.ruby-forum.com/u/hildegunst)\
**Post date:** [June 19, 2016, 11:57am UTC](https://www.ruby-forum.com/t/send-strict-transport-security-header-in-401-response/244815/2 "2016-06-19T11:57:54Z")

</div>

On Sun, Jun 19, 2016 at 11:51:28AM +0200, Thomas G. wrote:

Hi there,

> I would like to send the header:
> 
> add\_header Strict-Transport-Security “max-age=31536000; includeSubDomains”;
> 
> Despite the 401 Unauthorized request. Is that possible?

> **[Module ngx\_http\_headers\_module](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header)**
>
> The ngx\_http\_headers\_module module allows adding the “Expires” and “Cache-Control” header fields, and arbitrary fields, to a response header.

That suggests that you can use an “always” parameter.

Is that appropriate in this case?

If not, then possibly the third-party “headers more” module may be  
useful.

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![hildegunst](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/4bbf92/32.png) [@hildegunst](https://www.ruby-forum.com/u/hildegunst)\
**Post date:** [June 22, 2016, 2:55pm UTC](https://www.ruby-forum.com/t/send-strict-transport-security-header-in-401-response/244815/3 "2016-06-22T14:55:44Z")

</div>

Hello Francis,

- Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) [2016-06-19 11:57]:

> [Module ngx\_http\_headers\_module](http://nginx.org/r/add_header)

> That suggests that you can use an “always” parameter.

> Is that appropriate in this case?

yes, thank you a lot. That solved my problem.

Cheers,  
Thomas