Enable HTTP Strict Transport Security (HSTS) with spring boot application

Question

I have followed the article https://docs.spring.io/spring-security/site/docs/4.0.2.RELEASE/reference/html/headers.html#headers-hsts to enable HSTS header on my spring boot application. Despite of making the required changes, Strict-Transport-Security header is not appearing the response.

pom.xml (dependencies)

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-actuator</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-thymeleaf</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-config</artifactId>
    </dependency>
</dependencies>

WebSecurityConfig.java

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@EnableWebSecurity
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .headers()
            .httpStrictTransportSecurity()
                .includeSubDomains(true)
                .maxAgeInSeconds(31536000);
    }
}

List of headers:

cache-control →no-cache, no-store, max-age=0, must-revalidate
content-language →en-GB
content-type →text/html;charset=UTF-8
date →Thu, 24 May 2018 14:10:29 GMT
expires →0
pragma →no-cache
transfer-encoding →chunked
x-application-context →application:9000
x-content-type-options →nosniff
x-frame-options →SAMEORIGIN
x-xss-protection →1; mode=block

Am I missing anything?

score 16 · Accepted Answer · answered Nov 28 '18 at 15:12

16

In accordance with RFC6797, the HSTS header is only injected into HTTPS responses.

Source: https://docs.spring.io/spring-security/site/docs/4.0.2.RELEASE/reference/htmlsingle/#headers-hsts

answered Nov 28 '18 at 15:12

David Balažic

1,319
1
23
50

score 5 · Answer 2 · answered Jun 21 '18 at 11:47

5

It will only appear after the first request via HTTPS.

answered Jun 21 '18 at 11:47

Pri1me

117
2
9

score 4 · Answer 3 · answered Jun 02 '22 at 16:54

As mentioned in other answers, the default RequestMatcher used in HstsConfig is checking if a request is HTTPS. You can set another matcher if it's not working for you because TLS is not terminated by Spring Boot.

The code below ensures that the Strict-Transport-Security header is set in all responses:

    http.headers()
          .httpStrictTransportSecurity()
          .requestMatcher(AnyRequestMatcher.INSTANCE)
          ...

Enable HTTP Strict Transport Security (HSTS) with spring boot application

3 Answers3

Linked