How to modify standalone.xml directly for Nessus detects HSTS vulnerability ?

[Eric Lee]

JBoss EAP 7.3

We've HSTS configuation in standalone.xml such as below and it passed in the Fortify SCA

<filters> <response-header name="hsts-header" header-name="Strict-Transport-Security" header-value="max-age=31536000;"/> </filters>

but Nessus security scanner still detects HSTS missing...

Any suggestion ?

BTW,  for customer requirment, we disabled  

JBoss welcome page

Admin console (so we removed anything inside <management-interfaces>)

Many thanks.

[Bartosz Baranowski]

All inquires regarding EAP are handled via customer portal: https://access.redhat.com/

[Eric Lee]

We found an document from  https://access.redhat.com/solutions/7018417

And that soluction seems workable for admin console.

We already set Strict-Transport-Security header filter to the Undertow subsystem and we can see that header in response,

but Nessus scanner still detects RFC 6797.

Bartosz Baranowski 在 2024年3月7日 星期四晚上10:32:40 [UTC+8] 的信中寫道：