Security VIT related to The remote HTTPS server does not send the HTTP "Strict-Transport-Security" header

[nakiva9]

Version of Kpow
The version of Kpow you are running is [operatr/kpow:88.5]

Describe the issue
Our Security team scanned, the Kpow App and Server, and have identified a Vulnerability, as below

The remote HTTPS server does not send the HTTP
"Strict-Transport-Security" header.

The Summary is as follows
The remote web server is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections.

Additional context
we are mandated to resolve the Security Vulnerability, i looked at the Configuration and could not find any web server config file to add the following to remediate the issue

    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

we need help of the support on how to resolve this in our kPow environment, we use a licensed vesrion of the kPow

[d-t-w]

Hello @nakiva9 thanks for your message, we'll look into this and resolve in the next release (94.1).

As you are a licensed user, you can always access support via our ticketed support channels by emailing [email protected] to contact the factor house team.

[d-t-w]

Hello @nakiva9 a quick clarification and update on this ticket.

While investigating this issue we confirmed that Kpow does set the "Strict-Transport-Security" header for every response when SSL is configured, except for the 303/Redirect response that Kpow sends when you have also configured Jetty authentication and are accessing the UI as an unauthenticated user (Jetty redirects you to the login page).

At a guess this is how your automated scanning tool has encountered Kpow.

We have fixed that bug, ensured that the "Strict-Transport-Security" header is set on every response where SSL is configured, and have exposed these configurable environment variables (and default values):

"HTTPS_STS_MAX_AGE"            "31536000"
"HTTPS_STS_INCLUDE_SUBDOMAINS" "true"

This generates the following default HSTS header for responses where SSL is configured:

Strict-Transport-Security: max-age=31536000; includeSubDomains

Users can turn HSTS off by setting HTTPS_STS_MAX_AGE=-1, but default is on.

Thanks for raising this ticket, the bugfix is included the next release of Kpow (v94.1) I will leave it open until I can link to the full release notes. We expect to release v94.1 in January.

I notice that your ticket reference v88.5 which is quite old, with your license you are free to update Kpow at any time to any later version, and our team is more than happy to help if you need any assistance upgrading.