Tutorial: How to Set Up HTTP Strict Transport Security (HSTS) on Access Server
Overview
This tutorial guides you through setting up HTTP Strict Transport Security (HSTS) on Access Server. HSTS is a security feature that enforces secure HTTPS connections between clients and servers, preventing protocol downgrade attacks and cookie hijacking. While Access Server doesn't enable HSTS by default and it's not strictly required for Access Server functionality, certain organizations may have legal or compliance requirements (for example, government regulations) that mandate enabling HSTS headers even when no HTTP endpoint exists.
Access Server doesn't enable HSTS by default because it already serves web UIs over secure HTTPS rather than plain HTTP. While unnecessary in most cases, adding HSTS can enhance security or meet specific compliance needs. HSTS forces browsers to use only HTTPS connections, protecting against downgrade attacks and cookie hijacking.
However, since HSTS prevents overriding invalid SSL certificates, enabling it with Access Server's default self-signed certificate would block access to the web UIs. Therefore, HSTS is disabled unless you replace the default certificate with a valid one.