CABI V-222928 - HTTP Strict Transport Security (HSTS) must be enabled

Products

• CA Spectrum

Issue/Introduction

 

HTTP Strict Transport Security (HSTS) instructs web browsers to only use secure connections for all future requests when communicating with a website. Doing so helps prevent SSL protocol attacks, SSL stripping, cookie hijacking, and other attempts to circumvent SSL protection. Implementing HSTS requires testing of your web applications to ensure SSL certificates align correctly with application requirements and sub-domains if sub-domains are used. Ensure certificates are installed and working correctly. If sub-domains are in use, all sub-domains must be covered in the SSL/TLS certificate and the includeSubDomains directive must be specified in order for HSTS to function properly.


HTTP Strict Transport Security (HSTS) must be enabled

Environment

Release : 21.2

Component : Jaspersoft for CA Spectrum

Resolution

Enabled HSTS using the following  settings

 

Note:  A few changes needed from the STIG
              includeSubDomains   -changeTo-    hstsIncludeSubDomains
              maxAgeSeconds        -changeTo-    hstsMaxAgeSeconds

          Also enabled the antiClickJackingOption

            <param-name>antiClickJackingOption</param-name>
            <param-value>SAMEORIGIN</param-value>

 

/opt/CA/SharedComponents/CABI/apache-tomcat/conf/web.xml

<!-- START USARMY HSTS CHANGES -->

<filter>

<filter-name>httpHeaderSecurity</filter-name>

<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>

<init-param>

<param-name>hstsEnabled</param-name>

<param-value>true</param-value>

<param-name>hstsMaxAgeSeconds</param-name>

<param-value>31536000</param-value>

<param-name>hstsIncludeSubDomains</param-name>

<param-value>true</param-value>

<param-name>antiClickJackingOption</param-name>

<param-value>SAMEORIGIN</param-value>

</init-param>

<async-supported>true</async-supported>

</filter>

<!-- END USARMY HSTS CHANGES -->

 

 

<!-- The mapping for the HTTP header security Filter -->

<filter-mapping>

<filter-name>httpHeaderSecurity</filter-name>

<url-pattern>/*</url-pattern>

<dispatcher>REQUEST</dispatcher>

</filter-mapping>

 

 

Restart tomcat afterward

cd /opt/CA/SharedComponents/CABI
./stopServers.sh tomcat
./startServers.sh tomcat