Enable HSTS

You can enable HTTP Strict Transport Security (HSTSHTTP Strict Transport Security (HSTS) is a web security policy for protecting websites against protocol downgrade attacks and cookie hijacking.) to force browsers to connect securely via TLS or SSL when accessing the Application Studio user interface. Enabling HSTS involves editing an XML file to add some properties.

1. Open the web.xml file at <install directory>/app-studio/apache-tomcat-<version>/webapps/appstudio/WEB-INF.
2. Search for the JsonResponseFilter in the file.
3. Add the following snippet before the JsonResponseFilter. This placement is necessary so the HSTS filter processes all requests.

<filter>

<filter-name>HstsFilter</filter-name>

<filter-class>com.axway.defence.servlet.http.HstsFilter</filter-class>

<init-param>

<param-name>httpsPort</param-name>

<param-value>443</param-value>

</init-param>

<init-param>

<param-name>maxAge</param-name>

<param-value>86400</param-value>

</init-param>

<init-param>

<param-name>includeSubdomains</param-name>

<param-value>false</param-value>

</init-param>

</filter>

<filter-mapping>

<filter-name>HstsFilter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

4. The preceding snippet has default values for httpsPort, maxAge and includeSubdomains. You might have to edit the values for your environment. The following describes the parameters.

httpsPort

The port to forward HTTPS traffic.

maxAge

The maximum time in seconds that browsers recognize the HSTS policy.

includeSubdomains

Specifies whether subdomains of the requested domain also should recognize the policy.

5. Save the file and restart Application Studio for the changes to become effective.