How can the HSTS header be added to WebLogic?

Question

Is there an implementation for using the Strict-Transport-Security header to WebLogic? I figure it would be using something in web.xml under <security-constraint>

I know how to do this for an Apache based server, but I am unsure on adding it in for WebLogic.

Please note, with this instance I am unable to use Apache in front of WebLogic.

Man-I-n-MiddLeWare · Answer 1 · 2015-06-14T10:04:02.873

1

There is no any specific configuration for HSTS (HTTP Strict Transport Security ) on weblogic.

However, the installation can be configured to work on HTTPS protocol.

You can set 'transport-guarantee' to CONFIDENTIAL or INTEGRAL in web.xml. With that set, WebLogic Server will automatically redirect a client to the HTTPS port if the original request was over HTTP.

An example of the web.xml file entry is as follows:

<security-constraint> <user-data-constraint> <description>USE SSL</description> <transport-guarantee>CONFIDENTIAL</transport-guarantee> </user-data-constraint> </security-constraint>

edited Jun 14 '15 at 10:04

answered Jun 14 '15 at 09:37

Man-I-n-MiddLeWare

64
4

1

This does not answer the question. Although Weblogic may not include some specific configuration for sure can add custom headers (what HSTS is). Redirecting to HTTPS is not what HSTS accomplishes. – Eloy Roldán Paredes Feb 23 '16 at 18:55

score 1 · Answer 2 · answered Mar 04 '18 at 11:06

I would probably put Nginx in front of Weblogic as a reverse proxy, and use that to do the whole HTTPS thing, including HSTS.

Then all you have to do is add the following configuration to the Nginx configuration

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Nginx documentation for HSTS

How can the HSTS header be added to WebLogic?

2 Answers2