How To: Configure and Verify HTTP Strict Transport Security (HSTS) on SecureAuth IdP

Version Affected: All versions

 

Overview

This article explains whether HTTP Strict Transport Security (HSTS) is built into SecureAuth Identity Provider (IdP) and how to configure or verify it. IdP 9.1 and above has HSTS enabled by default, built into the IdP code at the realm level. IdP 9.0.2 and below does not have HSTS built in, and it must be added manually.

There are two methods below — use the one that matches your situation:

• Method 1: you are on IdP 9.1 or above and want to confirm HSTS is active, including when a scanning tool reports it as missing.
• Method 2: you are on IdP 9.0.2 or below and need to add the HSTS header manually, or you are on any version and want HSTS to also appear in a scan performed at the root (Default Web Site) level rather than the realm level.

In this article

• Method 1: Verify HSTS on 9.1 and Above
• Method 2: Manually Add the HSTS Header via IIS URL Rewrite

Method 1: Verify HSTS on 9.1 and Above

Use this method if you are on IdP 9.1 or above, where HSTS is enabled by default and requires no configuration.

1. Use the Security Headers tool to check your realm directly: navigate to https://<IdP_fqdn>/realm# in the tool. If HSTS is enabled, the tool reports it as present.
2. If you instead use a tool such as SSL Labs, be aware that it scans at the root (Default Web Site) level rather than at the individual realm level. Because HSTS is built into the IdP code at the realm level, a root-level scan may report HSTS as missing even though it is active on the realm.

If you need HSTS to also show as enabled in a root-level scan, continue to Method 2 below to add it via an IIS URL Rewrite outbound rule.

Method 2: Manually Add the HSTS Header via IIS URL Rewrite

Use this method on IdP 9.0.2 and below, where HSTS is not built in. This same rule can also be added at the root (Default Web Site) level on any IdP version, if you need a root-level scan to detect HSTS directly (see Method 1 above).

1. Open IIS Manager and right-click Default Web Site (or the site you want to add the header to).

2. In the site's folder, right-click web.config and open it in a text editor (for example, Notepad++).

3. Inside <system.webServer>, add the following outbound rule (merge it with any <rewrite> or <outboundRules> sections that already exist, rather than duplicating them):

<system.webServer>
  <rewrite>
    <outboundRules>
      <rule name="Add Strict-Transport-Security when HTTPS" enabled="true">
        <match serverVariable="RESPONSE_Strict_Transport_Security" pattern=".*" />
        <conditions>
          <add input="{HTTPS}" pattern="on" ignoreCase="true" />
        </conditions>
        <action type="Rewrite" value="max-age=31536000 ; includeSubDomains" />
      </rule>
    </outboundRules>
  </rewrite>
</system.webServer>

4. Save web.config. HSTS is now enabled for the site.

The screenshot below shows the completed web.config, with the outbound rule in place under system.webServer > rewrite > outboundRules.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.