HTTP Strict Transport Security (HSTS) not implemented

Description

During the scan, Cytrix managed to find that HTTP Strict Transport Security (HSTS) header is not being implemented. The Strict-Transport-Security response header is an opt-in security enhancement that is specified by a web application through the use of a special response headers.
HSTS prevents browsers from sending insecure HTTP communication to specific domains. It forces the browsers to only send communication over HTTPS.

An attacker could exploit this vulnerability to perform man-in-the-middle attacks (MITM).
This vulnerability could lead to a loss of confidentiality and more.

Severity/Score

CVSS Version 3.x – 3.1 Low

Recommendation

It is recommended to configure the web server so that it will always send the following HTTP headers in all server responses.
Strict-Transport-Security: max-age=31536000

References

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security

< Return to all Vulnerabilities

The Dark Web

Let’s talk about the darker and more mysterious side of the internet, also known as The Dark Web. You’ve probably heard about it, whether it’s

Read More »

What is a CWE ?

Similar to the article written on CVEs, in this article we will answer the questions :What is CWE ? and, what is the difference between

Read More »