Description
This article describes how to enable the HSTS for the admin login page.
The remote HTTPS server is not enforcing HTTP Strict Transport Security (HSTS).
The lack of HSTS allows downgrade attacks, and SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections.
Scope
From version 6.2.6.
Solution
From CLI.
config system global
set admin-hsts-max-age <value> <----- Range 0- 2147483647.
end
Note.
- HTTPS Strict-Transport-Security header max-age value in seconds. Meaning the number of seconds, the client should honor the HSTS setting.
- A value of 0 will reset any HSTS records in the browser. When admin-https-redirect is disabled the header max-age will be 0.
Verification.
- When the browser initiates the connection to the FortiGate, the unit will respond with the HSTS header for internal redirection.
Enable HSTS for VIP object.
Enabling it will add an HSTS header to each HTTP response.
Enabling it will add an HSTS header to each HTTP response.
Note: This is only available when the VIP operates as a Load Balance server object and is set to listen on port 443.
config firewall vip
edit <name>
set ssl-hsts enable
set ssl-hsts-age <value> <--- Range 60-157680000.
set ssl-hsts-include-subdomains enable
