topic Re: Vulnerabilty in HSTS QlikSense in Management & Governance

Vulnerabilty in HSTS QlikSense

fkeuroglian — Sat, 16 Nov 2024 05:08:23 GMT

Hi experts! how are you?

One client from auditory send me that there are one vulnerabilty in the QlikSense Server and send me this details:

The said that then have problem with the HEADER HSTS:

| http-security-headers:

| Strict_Transport_Security:

| HSTS not configured in HTTPS Server

| Cache_Control:

|_ Header: Cache-Control: no-cache

I found this article that said how we can modify the HSTS(link)

Someone have any other idea to control this?

Thanks a lot

Re: Vulnerabilty in HSTS QlikSense

Levi_Turner — Mon, 29 Jul 2019 14:42:28 GMT

I don't follow. If the issue is that the response header doesn't have HSTS defined then why doesn't that article fit? That's the route to edit any arbitrary HTTP header inside of Qlik Sense.

Re: Vulnerabilty in HSTS QlikSense

fkeuroglian — Mon, 29 Jul 2019 21:08:26 GMT

Levi how are you?

I do not have any experiencia dealing with the HSTS, the title of the article said "HTTP Strict Transport Security (HSTS) in Qlik Sense"

Because of that i asume that it is the way to change it, but clearly or pherhaps it isnt?

Change the question, what is the correct form to defined the HSTS in qliksense?

Thanks a lot for your time Levi

Fernando

Re: Vulnerabilty in HSTS QlikSense

Levi_Turner — Wed, 31 Jul 2019 01:00:46 GMT

What do you mean it isn't being sent? This is it in my environment:

Re: Vulnerabilty in HSTS QlikSense

Giuseppe_Novello — Wed, 31 Jul 2019 15:02:00 GMT

Hope you doing well, to answer you question:" What is the correct form to defined the HSTS in qliksense?". Well basically following the steps that the article provides? or is there anything else missing that we ( Levi) and I aren't getting? if you do, then please provide more clarity.

Gio

Re: Vulnerabilty in HSTS QlikSense

tlourenco — Thu, 11 Jun 2020 17:30:30 GMT

Hello all,

Did you find an answer to that Cache-control situation?

Ive tried adding it to the virtual proxy response header, but keep having it wrong...

Anyone knows the answer?

Kind regards.