https://community.qlik.com/t5/Suggest-an-Idea/Enable-HSTS-for-QEM-and-Replicate-webapps/idc-p/1821412#M6731 <P>This capability was made available for Enterprise Manager in version 7 (Nov 2020) release.&nbsp; Please refer to the following:&nbsp;<A href="https://help.qlik.com/en-US/enterprise-manager/May2021/Content/Global_Common/Content/SharedEMReplicate/Security/setting_hsts.htm" target="_blank">https://help.qlik.com/en-US/enterprise-manager/May2021/Content/Global_Common/Content/SharedEMReplicate/Security/setting_hsts.htm</A></P> Mon, 12 Jul 2021 12:12:55 GMT Shelley_Brennan 2021-07-12T12:12:55Z https://community.qlik.com/t5/Suggest-an-Idea/Enable-HSTS-for-QEM-and-Replicate-webapps/idi-p/1820518 <P>The Replicate and QEM web applications do not enforce HTTP Strict Transport Security (HSTS).</P><P>The application should instruct web browsers to only access the application using HTTPS. To do this, enable HTTP Strict Transport Security (HSTS) by adding a response header with the name 'Strict-Transport-Security' and the value 'max-age=expireTime', where expireTime is the time in seconds that browsers should remember that the site should only be accessed using HTTPS. Consider adding the 'includeSubDomains' flag if appropriate.</P><P>This is a security best practice recommended by our penetration testing team.</P> Wed, 07 Jul 2021 20:14:40 GMT https://community.qlik.com/t5/Suggest-an-Idea/Enable-HSTS-for-QEM-and-Replicate-webapps/idi-p/1820518 Prabodh 2021-07-07T20:14:40Z https://community.qlik.com/t5/Suggest-an-Idea/Enable-HSTS-for-QEM-and-Replicate-webapps/idc-p/1821412#M6731 <P>This capability was made available for Enterprise Manager in version 7 (Nov 2020) release.&nbsp; Please refer to the following:&nbsp;<A href="https://help.qlik.com/en-US/enterprise-manager/May2021/Content/Global_Common/Content/SharedEMReplicate/Security/setting_hsts.htm" target="_blank">https://help.qlik.com/en-US/enterprise-manager/May2021/Content/Global_Common/Content/SharedEMReplicate/Security/setting_hsts.htm</A></P> Mon, 12 Jul 2021 12:12:55 GMT https://community.qlik.com/t5/Suggest-an-Idea/Enable-HSTS-for-QEM-and-Replicate-webapps/idc-p/1821412#M6731 Shelley_Brennan 2021-07-12T12:12:55Z