Enable HTTP Strict Transport Security (HSTS) Headers¶

Enable HTTP Strict Transport Security (HSTS) headers for the applications deployed in your server, to confirm that the relevant headers are present in the HTTP response. HSTS is not enabled for applications in WSO2 Identity Server by default.

Enable for Management Console¶

If the HttpHeaderSecurityFilter element is available in the <IS_HOME>/repository/conf/tomcat/carbon/WEB-INF/web.xml file as shown below, it implies that security headers are by default configured for the WSO2 Management Consoles of all of your profiles. However, in a production deployment, Strict-Transport-Security needs to be explicitly enabled by replacing the default values of the HttpHeaderSecurityFilter filter.

Following is the default filter configuration.

<!-- Tomcat http header security filter -->
<filter>
        <filter-name>HttpHeaderSecurityFilter</filter-name>
        <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
        <init-param>
            <param-name>hstsEnabled</param-name>
            <param-value>false</param-value>
        </init-param>
</filter>

Shown below is how you should explicitly enable HSTS.

<!-- Tomcat http header security filter -->

<filter>
        <filter-name>HttpHeaderSecurityFilter</filter-name>
        <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
        <init-param>
            <param-name>hstsMaxAgeSeconds</param-name>
            <param-value>15768000</param-value>
        </init-param>
</filter>

Enable for web applications¶

Similar to the WSO2 Identity Server Management Console, check whether HttpHeaderSecurityFilter stored in the <IS_HOME>/repository/deployment/server/webapps/ directory is available in the web.xml file of that particular web application. If the filter is available, enable HSTS as shown below.

<filter>
    <filter-name>HttpHeaderSecurityFilter</filter-name>        
    <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
</filter>
<filter-mapping>     
    <filter-name>HttpHeaderSecurityFilter</filter-name>     
    <url-pattern>*</url-pattern>
</filter-mapping>

. To enable HSTS for a Jaggery application, change the default filter configuration as shown below.

Given below is the default filter configuration.

"params" : [{"name" : "hstsEnabled", "value" : "false"}]

This is the filter configuration after enabling HSTS.

"params" : [{"name" : "hstsMaxAgeSeconds", "value" : "15768000"}]

→