Поиск в Поддержке

Избегайте мошенников, выдающих себя за службу поддержки. Мы никогда не попросим вас позвонить, отправить текстовое сообщение или поделиться личной информацией. Сообщайте о подозрительной активности, используя функцию «Пожаловаться».

Подробнее

The security tab in developer console shows HSTS as disabled whereas we see all the response header under "Headers" tab

  • 4 ответа
  • 2 имеют эту проблему
  • 7 просмотров
  • Последний ответ от subodh.natu

more options

We recently implemented HSTS in our webapplication where using filter we send the HSTS headers back to browser. When we check any URL after logging in, we see the relevant HSTS response headers confirming that we have done the implementation correctly. But when we check the security tab, it shows "HSTS" as "Disabled".

How is browser determining that "HSTS" (HTTP Strict Transport Security) is disabled?

We recently implemented HSTS in our webapplication where using filter we send the HSTS headers back to browser. When we check any URL after logging in, we see the relevant HSTS response headers confirming that we have done the implementation correctly. But when we check the security tab, it shows "HSTS" as "Disabled". How is browser determining that "HSTS" (HTTP Strict Transport Security) is disabled?

Все ответы (4)

more options

If you have visited the website before then there might be a record in SiteSecurityServiceState.txt in the profile folder.

Can you post a link to a publicly accessible page (i.e. no authentication or signing on required)?

Can you attach a screenshot?

more options

I have attached the screen shot for the Response headers from the "Headers" tab and the screen shot from "Security" tab which shows "HSTS" as disabled.

Unfortunately I cannot share the link for the application as it is within the internal network and not accessible from outside.

Изменено subodh.natu

more options

Did you check the SiteSecurityServiceState.txt file?

more options

Yes I checked the "SiteSecurityServiceState.txt", it doesn't have that domain listed in the file.

I even created a new profile and accessed the site using the new profile, even then the domain doesn't show up in the new file.