Not sure if it might benefit others but I’ve recently had to enable HSTS to harden the HTTP redirect from Port 80 to 443.
Edited the web.xml file and located the HSTS Comments. (~Line 468)
Added the below filters
<!-- Enable HSTS -->
<filter>
<filter-name>
httpHeaderSecurity
</filter-name>
<filter-class>
org.apache.catalina.filters.HttpHeaderSecurityFilter
</filter-class>
<init-param>
<param-name>
hstsEnabled
</param-name>
<param-value>
true
</param-value>
</init-param>
<init-param>
<param-name>
hstsMaxAgeSeconds
</param-name>
<param-value>
31536000
</param-value>
</init-param>
<init-param>
<param-name>
hstsIncludeSubDomains
</param-name>
<param-value>
true
</param-value>
</init-param>
<init-param>
<param-name>
hstsPreload
</param-name>
<param-value>
true
</param-value>
</init-param>
<init-param>
<param-name>
antiClickJackingOption
</param-name>
<param-value>
ALLOW-FROM
</param-value>
</init-param>
<init-param>
<param-name>
antiClickJackingUri
</param-name>
<param-value>
https://OUR_PRIMARY_DOMAIN.HERE
</param-value>
</init-param>
<async-supported>
true
</async-supported>
</filter>
<!-- Enable HSTS Filter -->
<filter-mapping>
<filter-name>
httpHeaderSecurity
</filter-name>
<url-pattern>
/*
</url-pattern>
<dispatcher>
REQUEST
</dispatcher>
</filter-mapping>
My PowerShell script to check if it’s enabled:
PS: Maximum redirection can obviously be amended. If maxage… is returned then HSTS is enabled. Alternative is to check the Header using your Internet Browser’s Developer Tools.
#Author: Sameer Abdool
#Create Date: 22/02/2024
#Purpose: Check if HSTS Policy is enabled
#Replace value of ServerName
$ServerName = "YourServerName"
#Build URL
$Domain = ".your.domain.com"
$URL = "https://$ServerName$Domain"
#Check URL is correct
Write-Host "$URL"
#Trust All Certificates - This avoids trust relationship for the SSL/TLS secure channel in PowerShell
add-type @"
using System.Net;
using System.Security.Cryptography.X509Certificates;
public class TrustAllCertsPolicy : ICertificatePolicy {
public bool CheckValidationResult(
ServicePoint srvPoint, X509Certificate certificate,
WebRequest request, int certificateProblem) {
return true;
}
}
"@
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy
#Get the response headers by pulling out its Headers property
Invoke-WebRequest -Uri $URL -MaximumRedirection 10 | Select-Object -ExpandProperty Headers
