Qlik Web Connector - HSTS configuration

tevkar1 — Mon, 26 Jan 2026 21:26:37 GMT

Hi,

We have a Qlik Web Connector running June 2023 edition. We want to enable HSTS policy so that it applies only to the machine itself:

Strict-Transport-Security: max-age=31536000

When I enable HSTS via the <RequireHSTS> directive at deploy.config, HSTS is enabled for subdomains as well:

$ curl -s -D- https://xxxx.xxxx.xxxx .... Server: Microsoft-HTTPAPI/2.0 X-Content-Type-Options: nosniff x-frame-options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains ....

Is it possible to override that behaviour ?

Kind regards

Re: Qlik Web Connector - HSTS configuration

Sebastian_Linser — Mon, 29 Apr 2024 17:11:06 GMT

@tevkar1 Unfortunatelly you can't configure it further as of now. Please raise a feature request with Qlik.

https://community.qlik.com/t5/Official-Support-Articles/How-To-Submit-an-Idea-or-Propose-and-Improvement-For-Qlik/ta-p/1712581

It could be either for a custom header, so you can just add your own, or a second version of HSTS without the IncludeSubdomain option.

best regards

Sebastian

topic Qlik Web Connector - HSTS configuration in QlikView

Qlik Web Connector - HSTS configuration

Re: Qlik Web Connector - HSTS configuration