-1

We have added HSTS policy at Akamai level (domain). When we Intercept the request using burp we dont see HSTS policy is getting added in response, in case we hit site with http.

But with https we able to see the HSTS policy.

Issue is to fix this on http also. Can any expert provide some solution around it from the knowledge one has?

Thanks,

3

2 Answers 2

0

Maybe because Burp is intercepting the response and removing it.

Use Wireshark to investigate, you can make your browser export the SSL key used for the session and have Wireshark load the key, so you can decrypt the response.

0

The HSTS header MUST not be added to HTTP responses, as explained here.

Since you are asking about HSTS in HTTP responses, I assume that you actually want that HTTP requests are upgraded to HTTPS automatically.

This could be achieved by using a HTTPS redirect. For example, the following setting for .htaccess files would cause such redirect:

RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.<yourdomain>.com/$1 [R,L]

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .