Security

Question

• Creator
  Topic
• June 22, 2024 at 8:21 pm #4246900
  

  HSTS Missing From HTTPS Server (RFC 6797) No IIS installed

  by lewis.burrell · about 6 days, 9 hours ago

  Tags: Microsoft, Software, Windows

  Hi there I am doing a bit of testing with a product called Nessus and it has picked up the following

  HSTS Missing From HTTPS Server (RFC 6797)

  The remote web server is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS.

  The remote HTTPS server does not send the HTTP
  “Strict-Transport-Security” header.

  Output
  HTTP/1.1 401 Unauthorized
  Connection: close
  Server: WASABI/1.1
  Content-Length: 73

  Configure the remote web server to use HSTS.

  ————————————–

  This Server does not have IIS installed on it how can i enforce this server to use HSTS when responding? What file do i need to change?

  Any guidance would be great

  Thanks

• Creator
  Topic

All Answers

• Author
  Replies
• • June 23, 2024 at 11:52 am #4246921
    

    Since this is apparently a Web Server.

    by rproffitt · about 5 days, 17 hours ago

    In reply to HSTS Missing From HTTPS Server (RFC 6797) No IIS installed

    1. Ask support from nessus. See https://en.wikipedia.org/wiki/Nessus_(software)
    2. Ask https://en.wikipedia.org/wiki/Wasabi_Technologies if they support or will address what you found.

• Author
  Replies