[ARTEMIS-4123] Enable Strict-Transport-Security header

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.28.0
• Assignee: Domenico Francesco Bruscino
• Reporter: Domenico Francesco Bruscino
• Created: 04/Jan/23 11:07
• Updated: 14/Feb/23 10:26
• Resolved: 16/Jan/23 14:43

Description

The Strict-Transport-Security header is ignored by the browser when your site has only been accessed using HTTP. Once your site is accessed over HTTPS with no certificate errors, the browser knows your site is HTTPS capable and will honor the Strict-Transport-Security header. Browsers do this as attackers may intercept HTTP connections to the site and inject or remove the header.

Issue Links

• links to: GitHub Pull Request #4323