HTTP Strict Transport Security (HSTS) must be enabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-222928	TCAT-AS-000030	SV-222928r918125_rule		Low

Description
HTTP Strict Transport Security (HSTS) instructs web browsers to only use secure connections for all future requests when communicating with a website. Doing so helps prevent SSL protocol attacks, SSL stripping, cookie hijacking, and other attempts to circumvent SSL protection. Implementing HSTS requires testing of your web applications to ensure SSL certificates align correctly with application requirements and sub-domains if sub-domains are used. Ensure certificates are installed and working correctly. If sub-domains are in use, all sub-domains must be covered in the SSL/TLS certificate and the includeSubDomains directive must be specified in order for HSTS to function properly.

Description

HTTP Strict Transport Security (HSTS) instructs web browsers to only use secure connections for all future requests when communicating with a website. Doing so helps prevent SSL protocol attacks, SSL stripping, cookie hijacking, and other attempts to circumvent SSL protection. Implementing HSTS requires testing of your web applications to ensure SSL certificates align correctly with application requirements and sub-domains if sub-domains are used. Ensure certificates are installed and working correctly. If sub-domains are in use, all sub-domains must be covered in the SSL/TLS certificate and the includeSubDomains directive must be specified in order for HSTS to function properly.

STIG	Date
Apache Tomcat Application Server 9 Security Technical Implementation Guide	2023-06-05

Details

Check Text ( C-48815r754862_chk )
From the Tomcat server console, run the following command: sudo grep -i -A5 -B8 hstsEnable $CATALINA_BASE/conf/web.xml file. If the httpHeaderSecurity filter is commented out or if hstsEnable is not set to "true", this is a finding.

Fix Text (F-37850r918124_fix)
From the Tomcat server as a privileged user, edit the web.xml file: sudo nano $CATALINA_BASE/conf/web.xml file. Uncomment the existing httpHeaderSecurity filter section or create the filter section using the following code: NOTE: includeSubDomains param-value and url-pattern values may change and can vary according to local deployment requirements. httpHeaderSecurity org.apache.catalina.filters.HttpHeaderSecurityFilter hstsEnabled true hstsMaxAgeSeconds 31536000 hstsIncludeSubDomains true true Create or uncomment the httpHeaderSecurity filter mapping: httpHeaderSecurity /* REQUEST

Fix Text (F-37850r918124_fix)

From the Tomcat server as a privileged user, edit the web.xml file:

sudo nano $CATALINA_BASE/conf/web.xml file.

Uncomment the existing httpHeaderSecurity filter section or create the filter section using the following code:

NOTE: includeSubDomains param-value and url-pattern values may change and can vary according to local deployment requirements.

httpHeaderSecurity

org.apache.catalina.filters.HttpHeaderSecurityFilter

hstsEnabled

true

hstsMaxAgeSeconds

31536000

hstsIncludeSubDomains

true

Create or uncomment the httpHeaderSecurity filter mapping:

httpHeaderSecurity

REQUEST