Server Configurations

Apache

This boilerplate includes an app/.htaccess file that does three things:

  1. Redirect all traffic to HTTPS because ServiceWorker only works for encrypted traffic.
  2. Rewrite all pages (e.g. yourdomain.com/subpage) to yourdomain.com/index.html to let react-router take care of presenting the correct page.
  3. Ensure that sw.js is not cached. This is required for updates to be downloaded in offline-first mode.

Note: For performance reasons you should probably adapt this to run as a static .conf file (typically under /etc/apache2/sites-enabled or similar) so that your server doesn't have to apply these rules dynamically per request)

security

.htaccess can only provide security by redirecting HTTP to HTTPS

Note: For a detailed security configuration in apache httpd, a .conf file is necessary. You can use Mozilla's TLS Configurator to get some examples.

Nginx

An app/.nginx.conf file is included that does the same on an Nginx server.

security

Additionally, the .nginx.conf provides TLS security configuration settings based on Mozilla's TLS Guidelines, including:

  • HSTS Header
  • TLS 1.2 only
  • Prefer server-side ciphersuites
  • Strong ciphersuites
  • Own DH Key (optional)
  • OCSP & SSL Stapling (optional)
Edit this page