This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(316.8, 59%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EW%3C/text%3E%3C/svg%3E)
Hello,
I scanned my website with Nikto scanner and it showed me following information:
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The site uses SSL and Expect-CT header is not present.
+ All CGI directories 'found', use '-C none' to test none
+ Cookie .ASPXANONYMOUS created without the secure flag
In the HTTP Response Headers, I defined following parameters:
Which parameters must be added to solve those security vulnerabilities?
Thank you.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(80, 82%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBZ%3C/text%3E%3C/svg%3E)
Hi @WindowsGeek ,
You don't need to set Strict-Transport-Security in HTTP Response Headers. IIS provides a configure to set HSTS. I don't know much about NikTo scanner. But you can check these headers in browser. If them show in browser, that means they can work well.
Hello,
Thank you so much.
How about the "Max-Age" filed?
Hi @WindowsGeek ,
It means the browser should remember that a site is only to be accessed using HTTPS. The value you set is no problem. It won't expire until 365 days later.
When you check enable, max-age will can be set.
Hello,
The value of the Max-Age for mine is "0":
Any problem?
Hi @WindowsGeek ,
You need to edit it manually. The default value of it is 0 in IIS.
Hello,
Thank you so much for your reply.
What value is appropriate for the Max-Age field?
Hi @WindowsGeek ,
It is recommended to set 31536000. You can also set it according to your needs. Its unit is seconds.
Hello,
To solve the Cookie Session Without 'Secure' Flag vulnerability, I found this tutorial. In the <system.web> element, I have following line:
<httpCookies httpOnlyCookies="true" requireSSL="true" domain="String" />
But why problem existed?
Thank you.
Hi @WindowsGeek ,
You need to make sure the cookie exists on application so that the secure flag will work. Otherwise there is no place to set secure flag.
Or you can use url rewrite to set secure cookie.
<system.webServer>
<rewrite>
<outboundRules>
<rule name="Use only secure cookies" preCondition="Unsecured cookie">
<match serverVariable="RESPONSE_SET_COOKIE" pattern=".*" negate="false" />
<action type="Rewrite" value="{R:0}; secure" />
</rule>
<preConditions>
<preCondition name="Unsecured cookie">
<add input="{RESPONSE_SET_COOKIE}" pattern="." />
<add input="{RESPONSE_SET_COOKIE}" pattern="; secure" negate="true" />
</preCondition>
</preConditions>
</outboundRules>
</rewrite>
...
</system.webServer>
Hello,
Thank you so much for your reply.
I added above lines to the web.config file and after it some components of the website couldn't work properly! For example, page styles. Is this problem related to adding above lines?
Hi @WindowsGeek ,
You need to check the load of css files in browser. If css files load successfully but styles didnot show, the issue is caused by code. If they load failed, you can check status code.
The rule is used to set cookie in response headers, I don't think it will affect the components. Unless the component is not secure or the cookie is not set.