HTTP Strict Transport Security not set

Is the HSTS policy controlled by ALB? I don't see any option. How to fix this? I'm not using API gateway.

bwhaley 专家
1 年前
There is a good answer for this on stackoverflow: https://stackoverflow.com/a/51906978/2430241

主题

计算网络和内容交付 AWS 架构完善的框架

标签

网站配置弹性负载平衡安全

语言

English

rePost-User-olmec

已提问 1 年前2657 查看次数

1 回答

最新
投票最多
评论最多

这些答案有用吗？为正确答案投票，以帮助社区从您的知识中受益。

Hello,

I would suggest to introduce CloudFront and put the LB behind it. CloudFront allows you to set that header https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-http-security-headers/

Other benefits from CF is edge locations + low latency bare backbone AWS network, caching and last but not least could help in case of you are under DDoS attack.

Todor Todorov

已回答 1 年前

rePost-User-olmec
1 年前
As per the definition of HSTS, "HTTP Strict Transport Security (HSTS) is an HTTP header that notifies user agents to only connect to a given site over HTTPS, even if the scheme chosen was HTTP." I already redirect http request to https with 301 code in the ELB hence http is literally not possible. Isn't that suffice?

HTTP Strict Transport Security not set

相关内容