[NIFI-2437] Enforce HSTS to require HTTPS connections if available

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.0.0
• Fix Version/s: 1.9.0
• Component/s: Core Framework
• Labels: security
• Assignee: Nathan Gough
• Reporter: Andy LoPresto
• Created: 29/Jul/16 20:43
• Updated: 23/Feb/22 15:33
• Resolved: 23/Feb/22 15:33

Description

HTTP Strict Transport Security (HSTS) [1] [2] is a feature of HTTP which instructs browsers/clients to only communicate with a resource over HTTPS. It is implemented via a header sent in the response and future connections will require HTTPS.

[1] https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
[2] https://www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet

Issue Links

• Is contained by: NIFI-5458 Improve NiFi TLS and certificate management
• is fixed by: NIFI-5968 Add standard HTTP security headers
• is related to: NIFI-5587 Implement HPKP header
• is related to: NIFI-5968 Add standard HTTP security headers
• is related to: NIFI-6094 Add X-Content-Type-Options header