Network Management
Configure HTTP Strict Transport Security (HSTS) in SolarWinds Platform Web Console
This article explains how to enable HTTP Strict Transport Security (HSTS) in the SolarWinds Platform Web Console. Enabling HSTS helps protect your environment from downgrade attacks, SSL-stripping man-in-the-middle attacks, and cookie hijacking by ensuring browsers only communicate with the server over secure HTTPS connections.
First published date
Last published date
Overview
This article discusses how to enable the HTTP Strict Transport Security (HSTS) in Web Console settings.
Product section
Resolution
Follow these steps to enable HSTS in the SolarWinds Platform Web Console:
- Log in to the SolarWinds Platform Web Console.
- Navigate to Settings > All Settings.
- Under Product Specific Settings, click Web Console Settings.
- Locate and select the checkbox for Strict Transport Security (HSTS).
- Click Submit to apply the changes.
Once enabled, the web server will include the Strict-Transport-Security header in its responses, instructing browsers to only use HTTPS for future connections.
Additional Information
-
High Availability (HA) Environments:
In HA deployments, only the active node will respond with the correct HSTS headers. Security scanners may report the HSTS header as missing on the standby node, which will return an HTTP 400 error message. This is expected behavior. -
Version Considerations:
If you are running an older version of the SolarWinds Platform, consider upgrading to the latest supported version to ensure full HSTS support and other security enhancements. -
Alternative Configuration:
For more granular control or to enforce HSTS on all requests (including those not covered by the web console), you can configure HSTS at the IIS (Internet Information Services) level by adding a custom HTTP response header:- Name:
Strict-Transport-Security - Value:
max-age=31536000; includeSubDomains
- Name: