HTTP Security Header Not Detected -443

Question

Hi everyone

Someone have remedied this vulnerability? the "security team" have scanned and detect that.

The port is 443, IIS 10 , WS2016 DC

Thanks for suggestions

Answer 1

Sounds like HSTS to me. HSTS is a browser-only security feature. Basically it says that once a site has transitioned to HTTPS it cannot transition back to HTTP. This is a security feature that prevents a malicious user from getting an otherwise HTTPS encrypted site to send data unencrypted via HTTP. HSTS prevents this at the browser level. It is recommended that HSTS be turned on for all HTTPS sites.

To fix this you need to send the strict-transport-security header in all responses when using HTTPS. It is recommended that you use a third party library or OWIN middleware to handle this for you. Given your existing headers it appears you're using ASP.NET Webforms. Hanselman posted a blog article a long time ago on how to do this in ASP.NET. It would also work for ASP.NET MVC apps.

IIS 10.0 seems to support it out of the box but I haven't tried that approach.

OWIN-based apps have middleware to handle this so you can do it that way I believe. For ASP.NET Core it is supported out of the box using the approach given here.

Once you've made the change then the header will be sent in any response from the server over HTTPS.

Answer 2

Hi,

Just checking in to see if the information provided was helpful.
Please let us know if you would like further assistance.

Best Regards,
Vicky

Answer 3

Hi,

Just checking in to see if the information provided was helpful.

Please let us know if you would like further assistance.

Best Regards,
Vicky