Medium Vulnerability Description:
The HTTP Strict Transport Security (HSTS) policy header defines the timeframe in which a browser must connect to the webserver over HTTPS. Without this header being sent in all HTTPS responses, the webserver may be vulnerable to several attacks.
Impact
An attacker may be able to setup a fake web server and cause the application to make requests to an imitation server over HTTP.
Verification and Attack Information
Praetorian identified the lack of "Strict-Transport-Security" headers during an application walkthrough.
Recommendation
Add the HTTP Strict-Transport-Security header to all HTTPS responses. The syntax is as follows: Strict-Transport-Security: max-age=<seconds>[; includeSubDomains]
The parameter max-age gives the time frame for requirement of HTTPS in seconds and should be chosen quite high, e.g. several months. The flag includeSubDomains defines that the policy applies also for sub domains of the sender of the response.
References
https://www.owasp.org/index.php/HTTP_Strict_Transport_Security