Where can I configure HSTS for Azure resource group? Network Mapper scan job is throwing error - 'HSTS not configured in HTTPS Server' - for endpoint.

Question

Open cmd/terminal and run the following command : nmap -Pn -p443 --script http-security-headers 'endpoint'

Result : PORT STATE SERVICE 443/tcp open https | http-security-headers: | Strict_Transport_Security: |_ HSTS not configured in HTTPS Server

HSTS not configured in HTTPS Server - UNSAFE

Answer 1

@Rochishaa Anhal

Thank you for reaching out.The HTTP Strict-Transport-Security response header (often abbreviated as HSTS) informs browsers that the site should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically be converted to HTTPS.

In Azure such functionality is offered for Azure Front Door as documented here and Azure Application Gateway as documented here as these products deal HTTP servers. Can you please let us know the Azure service for which you want to enable HSTS?

Thanks.