Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 4 Current »

The HTTP HSTS is a mechanism that allows websites to declare that they can be only accessed via secure connection (HTTPS).

HTTP Strict-Transport-Security (HSTS) in Apache Tomcat can be enabled by following these steps. These steps are manual and will need to be performed every time FlexDeploy application is upgraded. If you are installing or upgrading, please follow all steps for install / upgrade and start Tomcat server. Once that is completed, stop Tomcat to perform following steps.

In your setenvoverride.sh or setenvoverride.bat file, set HSTS to 1.

To Disable, set HSTS to 0.

Linux

# Set FLEXDEPLOY_HSTS to 1 to enable HSTS. This allows only HTTPS browser connections to work.
# Set FLEXDEPLOY_HSTS to 0 to disable HSTS. This allows HTTP connections to work.
FLEXDEPLOY_HSTS=0

Windows

@rem Set FLEXDEPLOY_HSTS to 1 to enable HSTS. This allows only HTTPS browser connections to work.
@rem Set FLEXDEPLOY_HSTS to 0 to disable HSTS. This allows HTTP connections to work.
set FLEXDEPLOY_HSTS=0

If you enable HSTS, you probably want to also set SECURE_COOKIE to 1 in addition.

Linux

# Set FLEXDEPLOY_COOKIE_SECURE to 1 to enable secure session cookies. This requires HTTPS, or a load balancer using HTTPS.
# Set FLEXDEPLOY_COOKIE_SECURE to 0 to disable secure session cookies. This allows HTTP connections to work.
FLEXDEPLOY_COOKIE_SECURE=0

Windows

@rem Set FLEXDEPLOY_COOKIE_SECURE to 1 to enable secure session cookies. This requires HTTPS, or a load balancer using HTTPS.
@rem Set FLEXDEPLOY_COOKIE_SECURE to 0 to disable secure session cookies. This allows HTTP connections to work.
set FLEXDEPLOY_COOKIE_SECURE=0
  • No labels