# Post Nextstrain results on the public website, securely

**URL:** <https://nextstrain.discourse.group/t/post-nextstrain-results-on-the-public-website-securely/1029>\
**Category:** Help and Getting Started\
**Created:** [March 7, 2022, 11:53pm UTC](https://nextstrain.discourse.group/t/post-nextstrain-results-on-the-public-website-securely/1029 "2022-03-07T23:53:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![abombin](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@abombin](https://nextstrain.discourse.group/u/abombin)\
**Post date:** [March 7, 2022, 11:53pm UTC](https://nextstrain.discourse.group/t/post-nextstrain-results-on-the-public-website-securely/1029/1 "2022-03-07T23:53:07Z")

</div>

Hello,  
Is there a way to include HSTS response header for the link generated by auspice?

We are trying to share results of the workflow through the university resources and that is the security’s team request.

I apologize if I am missing something very basic.

Thank you.  
Andrei

---

<div class="post-metadata">

**Author:** ![trs](https://yyz1.discourse-cdn.com/flex031/user_avatar/nextstrain.discourse.group/trs/32/5_2.png) [@trs](https://nextstrain.discourse.group/u/trs)\
**Post date:** [March 8, 2022, 6:38pm UTC](https://nextstrain.discourse.group/t/post-nextstrain-results-on-the-public-website-securely/1029/2 "2022-03-08T18:38:18Z")

</div>

@abombin Can you be more specific in what you mean when you say “link generated by Auspice”? What’s an example of a URL you’d like to use HSTS?

We may be able to add the Strict-Transport-Security header to [nextstrain.org](http://nextstrain.org) and/or [auspice.us](http://auspice.us), but note that wouldn’t impact a local server using Auspice. For that you’d want to add the headers to your own deployment, such as at a reverse proxy.

---

<div class="post-metadata">

**Author:** ![abombin](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@abombin](https://nextstrain.discourse.group/u/abombin)\
**Post date:** [March 8, 2022, 6:52pm UTC](https://nextstrain.discourse.group/t/post-nextstrain-results-on-the-public-website-securely/1029/3 "2022-03-08T18:52:07Z")

</div>

> [@abombin](#):
>
> HSTS

Thank you. Yes, my question was about modifying the link generated by the local server with

```auto
nextstrain view auspice 

```

I was thinking that since there are options to select the host and the port, perhaps there is an option for HSTS.  
Thank you for answering my question.

---

<div class="post-metadata">

**Author:** ![trs](https://yyz1.discourse-cdn.com/flex031/user_avatar/nextstrain.discourse.group/trs/32/5_2.png) [@trs](https://nextstrain.discourse.group/u/trs)\
**Post date:** [March 8, 2022, 6:58pm UTC](https://nextstrain.discourse.group/t/post-nextstrain-results-on-the-public-website-securely/1029/4 "2022-03-08T18:58:48Z")

</div>

Ah, I see. Yeah, HSTS isn’t applicable in that case because of the emphemeral nature of `nextstrain view`, plus it doesn’t support HTTPS. You could put a TLS-terminating reverse proxy in front of `nextstrain view` (or `auspice view`) and apply HSTS headers there if you wanted.

---

<div class="post-metadata">

**Author:** ![abombin](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@abombin](https://nextstrain.discourse.group/u/abombin)\
**Post date:** [March 8, 2022, 7:03pm UTC](https://nextstrain.discourse.group/t/post-nextstrain-results-on-the-public-website-securely/1029/5 "2022-03-08T19:03:34Z")

</div>

Thank you very much for your suggestion!