Stack Overflow
Stack Overflow

Questions tagged [hsts]

HTTP Strict Transport Security (HSTS) is a web security policy mechanism whereby a web server declares that complying user agents are to interact with it using only secure HTTPS connections.

HSTS is based on research done by Adam Barth and Colin Jackson on the ForceHTTPS protocol starting in 2008, which evolved into the ForceTLS protocol and finally the HSTS protocol.

References

326 questions
0
votes
1 answer

IE Edge not honoring Lambda@Edge HSTS

I have a React app hosted in AWS S3. To help secure it, I have implemented Lambda@Edge following the AWS guide: https://aws.amazon.com/blogs/networking-and-content-delivery/adding-http-security-headers-using-lambdaedge-and-amazon-cloudfront/ The…
react-dev
  • 348
  • 1
  • 3
  • 10
0
votes
2 answers

nginx SSL and hsts questions

I have an Nginx with SSL already without HSTS. But in the backend, few services are not https. Is there any potential risk for the enable the HSTS? I am worried about the HSTS header will break the internal route when the HSTS header exists, force…
Izek Chen
  • 1
  • 1
0
votes
0 answers

WinServer 2019 Standard Https Issue

Recently installed Windows Server 2019 Standard (legit and activated) and migrated my mail server over to this server. I noticed after I was done that I cannot browse the web if the website uses https. Below I attached pictures and I have tried to…
Shiphted
  • 1
  • 2
0
votes
1 answer

Do applications have to explicitly implement action to HHTPS HSTS?

I found that most modern browsers support HSTS and switch over to HTTPS if they find it in the HTTP/HTTPS headers for the domain. Browsers would implemented appropriate response to teh HSTS header. What about client applications that are making…
user2512997
  • 71
  • 2
  • 6
0
votes
0 answers

Fails with No HSTS Header

I'm trying to add HSTS to my site. I added the line for it and then checked it here but it fails with "No HSTS header". The site is configured to use www and in researching this failure, it seems I have to redirect to non-www first. I already had…
user3052443
  • 758
  • 1
  • 7
  • 22
0
votes
1 answer

HSTS enabled site and Penetration test

I setup our .NET web application so that it has HSTS enabled. I verfied this by going to https://gf.dev/hsts-test and put in our URL and it shows that HSTS protection is there. The result shows: Strict-Transport-Security max-age=31536000;…
Fylix
  • 2,551
  • 6
  • 45
  • 72
0
votes
1 answer

Implement HTTP Strict Transport Security (HSTS) on VisualSVN

Our cycber security have recommended the introduction of HTTP Strict-Transport-Security response headers, but cannot see anywhere in VisualSVN (or the configuration of it) to do this. This is for VisualSVN Enterprise 4.2.2 (using Apache 1.10.6)…
Sean
  • 862
  • 8
  • 28
0
votes
0 answers

Java Spring Strict-Transport-Security Overridden When Deployed

I'm new to Java Spring security. I've been able to successfully add some HTTP headers and deploy them via the code I have below. Once the basic HTTP headers were working, I also added headers for Strict-Transport-Security. It seems to work…
Rob Horton
  • 785
  • 3
  • 9
  • 27
0
votes
1 answer

Will setting HstsOptions.IncludeSubDomains from an app hosted in a sub domain, affect other sub domains?

I've got an ASP.NET Core 3 application, which is hosted under a sub-domain. If I set HstsOptions.IncludeSubDomains to true, will that make changes to other domains/apps hosted to the main domain, or it will be sub-domains on even lower level (for…
SpiritBob
  • 2,355
  • 3
  • 24
  • 62
0
votes
0 answers

How to enable HSTS for asp.net project on IIS 8.5

I have been looking for how to enable HSTS on ASP.NET application. Finally found a way but I'm a bit confused with the value of tags. Please prefer the XML below, does the values in parentheses indicate that I should replace it with my value or are…
Amir
  • 28
  • 12
0
votes
1 answer

Web page security - http, https, hsts

I have web server IIS, where I have direct access to page like (page.com), so thats the reason why I have allowed HTTP (port 80) and then I am using HTTPS (port 443). When user enters the page on port 80 (page.com), he will be redirected to HTTPS…
Sirdhemond
  • 63
  • 1
  • 8
0
votes
1 answer

Are Cloudflare's warnings about HSTS overblown?

The warnings Cloudflare presents me with about enabling HSTS are both lengthy and full of dire warnings describing a few situations in which my users will not be able to visit my site for up to 6 months (i.e. forever). example here It seems to me…
jsharpe
  • 2,546
  • 3
  • 26
  • 42
0
votes
1 answer

Use app.usehsts() in the case of a proxy server apache

In case I use an apache proxy server for my ASP Net Core 2.2 app, what actually happens when I use app. UseHsTs();?
AED
  • 101
  • 2
0
votes
1 answer

Adding HTST header in my internal website doesn't work as expected

I have created a website where I am trying to add the HSTS security header via httpd.conf Header always set Strict-Transport-Security 'max-age=4000; includeSubDomains' Adding the above code, able to see the…
ragul rangarajan
  • 167
  • 2
  • 12
0
votes
1 answer

Did Not Connect: Potential Security Issue

Not able to continue visiting my local development website. Because browsers are blocking the site and common problem is HSTS. Unable to figure out what's gone wrong. Recently I setup new system for web development. Everything was working well since…
Vin.AI
  • 2,369
  • 2
  • 19
  • 40
1 2 3
…
21 22