-
Type:
Change Request
-
Status:
Closed
-
Priority:
Medium
-
Resolution:
Done
-
-
-
Module:
BenAdmin
- Security
-
-
Item State:
Production Complete
- Closed
-
Issue Importance:
Must Have
Vulnerability Description:
The HTTP Strict Transport Security (HSTS) policy header defines the timeframe in which a browser must connect to the webserver over HTTPS. Without this header being sent in all HTTPS responses, the webserver may be vulnerable to several attacks.
Impact
An attacker may be able to setup a fake web server and cause the application to make requests to an imitation server over HTTP.
Verification and Attack Information
Praetorian identified the lack of "Strict-Transport-Security" headers during an application walkthrough.
Recommendation
Add the HTTP Strict-Transport-Security header to all HTTPS responses. The syntax is as follows: Strict-Transport-Security: max-age=<seconds>[; includeSubDomains]
The parameter max-age gives the time frame for requirement of HTTPS in seconds and should be chosen quite high, e.g. several months. The flag includeSubDomains defines that the policy applies also for sub domains of the sender of the response.
References
https://www.owasp.org/index.php/HTTP_Strict_Transport_Security
{"report":{"apdex":0.5,"isInitial":true,"journeyId":"92d2e9b2-fc1f-4e67-9cf9-487f1acc789f","key":"jira.project.issue.view-issue","navigationType":0,"readyForUser":1034.7000007629395,"redirectCount":0,"resourceLoadedEnd":1392.8000001907349,"resourceLoadedStart":232.80000019073486,"resourceTiming":[{"duration":290.1000003814697,"initiatorType":"link","name":"https://jira.workterra.net/s/3003653444a1e1a85555cab7dcfb3a21-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/css/_super/batch.css","startTime":232.80000019073486,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":232.80000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":522.9000005722046,"responseStart":0,"secureConnectionStart":0},{"duration":289.4000005722046,"initiatorType":"link","name":"https://jira.workterra.net/s/dd6a0911920485696ac20493290df627-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/css/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&richediton=true","startTime":233.5,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":233.5,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":522.9000005722046,"responseStart":0,"secureConnectionStart":0},{"duration":289.69999980926514,"initiatorType":"link","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.css","startTime":233.70000076293945,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":233.70000076293945,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":523.4000005722046,"responseStart":0,"secureConnectionStart":0},{"duration":289.6000003814697,"initiatorType":"link","name":"https://jira.workterra.net/s/bd548f27bbf8f278bd83b60dd3284ed8-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static-adgs/jira.webresources:global-static-adgs.css","startTime":233.80000019073486,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":233.80000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":523.4000005722046,"responseStart":0,"secureConnectionStart":0},{"duration":289.5,"initiatorType":"link","name":"https://jira.workterra.net/s/70725731a158a7140f19ddbd4201ba27-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static/jira.webresources:global-static.css","startTime":233.9000005722046,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":233.9000005722046,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":523.4000005722046,"responseStart":0,"secureConnectionStart":0},{"duration":320.80000019073486,"initiatorType":"script","name":"https://jira.workterra.net/s/f2623af22c15df767ec6ff268ae0b8bd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/js/_super/batch.js?locale=en-US","startTime":233.9000005722046,"connectEnd":233.9000005722046,"connectStart":233.9000005722046,"domainLookupEnd":233.9000005722046,"domainLookupStart":233.9000005722046,"fetchStart":233.9000005722046,"redirectEnd":0,"redirectStart":0,"requestStart":233.9000005722046,"responseEnd":554.7000007629395,"responseStart":554.7000007629395,"secureConnectionStart":233.9000005722046},{"duration":399.1000003814697,"initiatorType":"script","name":"https://jira.workterra.net/s/6ce676f2a5bcc9651cef6e7956f05def-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/js/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":234.10000038146973,"connectEnd":234.10000038146973,"connectStart":234.10000038146973,"domainLookupEnd":234.10000038146973,"domainLookupStart":234.10000038146973,"fetchStart":234.10000038146973,"redirectEnd":0,"redirectStart":0,"requestStart":234.10000038146973,"responseEnd":633.2000007629395,"responseStart":633.2000007629395,"secureConnectionStart":234.10000038146973},{"duration":405.6000003814697,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/4.1.5/_/download/resources/com.atlassian.plugins.atlassian-chaperone:hotspot-tour/hotspot-tour.js?batch=false&locale=en-US","startTime":234.30000019073486,"connectEnd":234.30000019073486,"connectStart":234.30000019073486,"domainLookupEnd":234.30000019073486,"domainLookupStart":234.30000019073486,"fetchStart":234.30000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":234.30000019073486,"responseEnd":639.9000005722046,"responseStart":639.9000005722046,"secureConnectionStart":234.30000019073486},{"duration":406.1000003814697,"initiatorType":"script","name":"https://jira.workterra.net/s/6aa3fcf1fac5fd551eee0b69077524e6-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/aae1242f5fc81cc6a5bb8bc963ccda29/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en-US","startTime":234.30000019073486,"connectEnd":234.30000019073486,"connectStart":234.30000019073486,"domainLookupEnd":234.30000019073486,"domainLookupStart":234.30000019073486,"fetchStart":234.30000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":234.30000019073486,"responseEnd":640.4000005722046,"responseStart":640.4000005722046,"secureConnectionStart":234.30000019073486},{"duration":406.30000019073486,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":234.4000005722046,"connectEnd":234.4000005722046,"connectStart":234.4000005722046,"domainLookupEnd":234.4000005722046,"domainLookupStart":234.4000005722046,"fetchStart":234.4000005722046,"redirectEnd":0,"redirectStart":0,"requestStart":234.4000005722046,"responseEnd":640.7000007629395,"responseStart":640.7000007629395,"secureConnectionStart":234.4000005722046},{"duration":406.3999996185303,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":234.60000038146973,"connectEnd":234.60000038146973,"connectStart":234.60000038146973,"domainLookupEnd":234.60000038146973,"domainLookupStart":234.60000038146973,"fetchStart":234.60000038146973,"redirectEnd":0,"redirectStart":0,"requestStart":234.60000038146973,"responseEnd":641,"responseStart":641,"secureConnectionStart":234.60000038146973},{"duration":406.69999980926514,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.js?locale=en-US","startTime":234.60000038146973,"connectEnd":234.60000038146973,"connectStart":234.60000038146973,"domainLookupEnd":234.60000038146973,"domainLookupStart":234.60000038146973,"fetchStart":234.60000038146973,"redirectEnd":0,"redirectStart":0,"requestStart":234.60000038146973,"responseEnd":641.3000001907349,"responseStart":641.3000001907349,"secureConnectionStart":234.60000038146973},{"duration":407.3999996185303,"initiatorType":"link","name":"https://jira.workterra.net/s/05c862146699bb029ceb0a489075e63b-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/bcd66e9a133a1b9f5fd14b56841e1c5b/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":235.4000005722046,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":235.4000005722046,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":642.8000001907349,"responseStart":0,"secureConnectionStart":0},{"duration":406.19999980926514,"initiatorType":"script","name":"https://jira.workterra.net/rest/api/1.0/shortcuts/805012/d86515d5f85e345261e03597bd3941f3/shortcuts.js?context=issuenavigation&context=issueaction","startTime":235.4000005722046,"connectEnd":235.4000005722046,"connectStart":235.4000005722046,"domainLookupEnd":235.4000005722046,"domainLookupStart":235.4000005722046,"fetchStart":235.4000005722046,"redirectEnd":0,"redirectStart":0,"requestStart":235.4000005722046,"responseEnd":641.6000003814697,"responseStart":641.6000003814697,"secureConnectionStart":235.4000005722046},{"duration":407.5,"initiatorType":"link","name":"https://jira.workterra.net/s/9095228fa10daa2d3e3d7d5760c95e91-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.css?jira.create.linked.issue=true&richediton=true","startTime":235.5,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":235.5,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":643,"responseStart":0,"secureConnectionStart":0},{"duration":406.3999996185303,"initiatorType":"script","name":"https://jira.workterra.net/s/c19a1b46e985d7fb85efaf27c8febfdd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.js?jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":235.70000076293945,"connectEnd":235.70000076293945,"connectStart":235.70000076293945,"domainLookupEnd":235.70000076293945,"domainLookupStart":235.70000076293945,"fetchStart":235.70000076293945,"redirectEnd":0,"redirectStart":0,"requestStart":235.70000076293945,"responseEnd":642.1000003814697,"responseStart":642.1000003814697,"secureConnectionStart":235.70000076293945}],"threshold":1000,"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":151,"responseStart":227,"responseEnd":228,"domLoading":230,"domInteractive":1533,"domContentLoadedEventStart":1533,"domContentLoadedEventEnd":1605,"domComplete":2184,"loadEventStart":2184,"loadEventEnd":2186,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[],"measures":[],"correlationId":"186b55410daac6","effectiveType":"4g","downlink":10,"rtt":0,"serverDuration":47,"dbReadsTimeInMs":2,"dbConnsTimeInMs":3,"applicationHash":"156decd7d2b4272533aa6cefc8294af635e1da97","experiments":[]}}
Steps to Configure Server for HTTP Strict Transport Security Header
1. Open IIS Manager and Select Project (Site).
2. Open "HTTP Response Header" and Click on "Add" button from Actions pane.
3. Add following Name and Value:
Name: Strict-Transport-Security
Value : max-age=31536000; includeSubDomains
Note : This will edit Web.Config file of Web Projects