Return
-
Title
Security Scan reports indicate that pages in Foglight have Strict-Transport-Security (HSTS) disabled -
Description
Security scans report an issue regarding the use of the Strict-Transport-Security header in Foglight. The login page returns a correct header, but other pages return the header with a max-age=0 parameter that essentially disables the security policy.The Foglight server should return the header with a non-zero max-age parameter for all HTTPS requests. -
Cause
Known Defect referenced by Tracking ID FOG-230 -
Resolution
Foglight Management Server (FMS) version 5.9.5 and higher implemented an HSTS configuration setting of max-age=31536000 for login page would allow the browser to cache the configuration for the server when establishing a connection.
However if a scanning tool expects this response for every page then additional configuration setting is required.
WORKAROUND
The following workaround can be used:
- Stop Foglight Management Server (FMS) service/daemon
- Navigate to folder \server\web\console.war\WEB-INF
- Make a copy of web.xml file and save it to some different location
- Add below lines under HTTP Header Security Filter section in web.xml file
- Save the changes
- Start FMS service/daemon
STATUS
Defect ID FOG-230 has fixed in the 6.0 and higher releases of Foglight.
-
Defect ID
FOG-230