Skip to content

Commit 85a7de6

Browse files
nilasininilasini
authored
Merge pull request #5513 from deshankoswatte/hsts-documentation-fix
[Docs] Correct HSTS configuration steps for Console and web applications
2 parents 81f5f6a + e3e8cd0 commit 85a7de6

File tree

2 files changed

+56
-58
lines changed

2 files changed

+56
-58
lines changed

‎en/identity-server/7.1.0/docs/deploy/security/enable-hsts.md‎

Lines changed: 28 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -5,55 +5,54 @@ Enable HTTP Strict Transport Security (HSTS) headers for the applications deploy
55
!!! note
66
HSTS should not be enabled in development environments because transport security validations can interrupt the development processes by validating signatures of self-signed certificates.
77

8-
## Enable for Console
8+
## Enable for console
99

10-
If the `HttpHeaderSecurityFilter` element is available in the `<IS_HOME>/repository/conf/tomcat/console/WEB-INF/web.xml` file as shown below, it implies that security headers are by default configured for the WSO2 Identity Server Consoles of all of your profiles.
11-
However, in a production deployment, Strict-Transport-Security needs to be explicitly enabled by replacing the default <init-param> values of the `HttpHeaderSecurityFilter` filter.
10+
To enable HSTS for the WSO2 Identity Server Console, update the `web.xml` file located at
11+
`<IS_HOME>/repository/deployment/server/webapps/console/WEB-INF` and add the following filter configuration:
1212

13-
Following is the default filter configuration.
14-
15-
```
16-
<!-- Tomcat http header security filter -->
13+
```xml
14+
<!-- Tomcat HTTP header security filter -->
1715
<filter>
18-
<filter-name>HttpHeaderSecurityFilter</filter-name>
19-
<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
20-
<init-param>
21-
<param-name>hstsEnabled</param-name>
22-
<param-value>false</param-value>
23-
</init-param>
16+
<filter-name>HttpHeaderSecurityFilter</filter-name>
17+
<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
18+
<init-param>
19+
<param-name>hstsMaxAgeSeconds</param-name>
20+
<param-value>15768000</param-value>
21+
</init-param>
2422
</filter>
23+
24+
<filter-mapping>
25+
<filter-name>HttpHeaderSecurityFilter</filter-name>
26+
<url-pattern>*</url-pattern>
27+
</filter-mapping>
2528
```
2629

27-
Shown below is how you should explicitly enable HSTS.
30+
This configuration explicitly enables HSTS for the Console application.
2831

29-
```
30-
<!-- Tomcat http header security filter -->
31-
32-
<filter>
33-
<filter-name>HttpHeaderSecurityFilter</filter-name>
34-
<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
35-
<init-param>
36-
<param-name>hstsMaxAgeSeconds</param-name>
37-
<param-value>15768000</param-value>
38-
</init-param>
39-
</filter>
40-
```
32+
## Enable for other web applications
4133

42-
## Enable for web applications
34+
To enable HSTS for other web applications deployed in WSO2 Identity Server, update the respective `web.xml` file under
35+
`<IS_HOME>/repository/deployment/server/webapps/<WEBAPP_NAME>/WEB-INF`.
4336

44-
Similar to the WSO2 Identity Server Console, check whether the `HttpHeaderSecurityFilter` stored in the `<IS_HOME>/repository/deployment/server/webapps/` directory is available in the `web.xml` file of that particular web application. If the filter is available, enable HSTS as shown below.
37+
Add the same filter configuration used for the Console:
4538

46-
```
39+
```xml
4740
<filter>
4841
<filter-name>HttpHeaderSecurityFilter</filter-name>
4942
<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
43+
<init-param>
44+
<param-name>hstsMaxAgeSeconds</param-name>
45+
<param-value>15768000</param-value>
46+
</init-param>
5047
</filter>
48+
5149
<filter-mapping>
5250
<filter-name>HttpHeaderSecurityFilter</filter-name>
5351
<url-pattern>*</url-pattern>
5452
</filter-mapping>
5553
```
5654

55+
This configuration applies HSTS consistently across specified web applications running on WSO2 Identity Server.
5756

5857
<!--## Enable for Jaggery applications
5958

‎en/identity-server/next/docs/deploy/security/enable-hsts.md‎

Lines changed: 28 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -5,55 +5,54 @@ Enable HTTP Strict Transport Security (HSTS) headers for the applications deploy
55
!!! note
66
HSTS should not be enabled in development environments because transport security validations can interrupt the development processes by validating signatures of self-signed certificates.
77

8-
## Enable for Console
8+
## Enable for console
99

10-
If the `HttpHeaderSecurityFilter` element is available in the `<IS_HOME>/repository/conf/tomcat/console/WEB-INF/web.xml` file as shown below, it implies that security headers are by default configured for the WSO2 Identity Server Consoles of all of your profiles.
11-
However, in a production deployment, Strict-Transport-Security needs to be explicitly enabled by replacing the default <init-param> values of the `HttpHeaderSecurityFilter` filter.
10+
To enable HSTS for the WSO2 Identity Server Console, update the `web.xml` file located at
11+
`<IS_HOME>/repository/deployment/server/webapps/console/WEB-INF` and add the following filter configuration:
1212

13-
Following is the default filter configuration.
14-
15-
```
16-
<!-- Tomcat http header security filter -->
13+
```xml
14+
<!-- Tomcat HTTP header security filter -->
1715
<filter>
18-
<filter-name>HttpHeaderSecurityFilter</filter-name>
19-
<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
20-
<init-param>
21-
<param-name>hstsEnabled</param-name>
22-
<param-value>false</param-value>
23-
</init-param>
16+
<filter-name>HttpHeaderSecurityFilter</filter-name>
17+
<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
18+
<init-param>
19+
<param-name>hstsMaxAgeSeconds</param-name>
20+
<param-value>15768000</param-value>
21+
</init-param>
2422
</filter>
23+
24+
<filter-mapping>
25+
<filter-name>HttpHeaderSecurityFilter</filter-name>
26+
<url-pattern>*</url-pattern>
27+
</filter-mapping>
2528
```
2629

27-
Shown below is how you should explicitly enable HSTS.
30+
This configuration explicitly enables HSTS for the Console application.
2831

29-
```
30-
<!-- Tomcat http header security filter -->
31-
32-
<filter>
33-
<filter-name>HttpHeaderSecurityFilter</filter-name>
34-
<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
35-
<init-param>
36-
<param-name>hstsMaxAgeSeconds</param-name>
37-
<param-value>15768000</param-value>
38-
</init-param>
39-
</filter>
40-
```
32+
## Enable for other web applications
4133

42-
## Enable for web applications
34+
To enable HSTS for other web applications deployed in WSO2 Identity Server, update the respective `web.xml` file under
35+
`<IS_HOME>/repository/deployment/server/webapps/<WEBAPP_NAME>/WEB-INF`.
4336

44-
Similar to the WSO2 Identity Server Console, check whether the `HttpHeaderSecurityFilter` stored in the `<IS_HOME>/repository/deployment/server/webapps/` directory is available in the `web.xml` file of that particular web application. If the filter is available, enable HSTS as shown below.
37+
Add the same filter configuration used for the Console:
4538

46-
```
39+
```xml
4740
<filter>
4841
<filter-name>HttpHeaderSecurityFilter</filter-name>
4942
<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
43+
<init-param>
44+
<param-name>hstsMaxAgeSeconds</param-name>
45+
<param-value>15768000</param-value>
46+
</init-param>
5047
</filter>
48+
5149
<filter-mapping>
5250
<filter-name>HttpHeaderSecurityFilter</filter-name>
5351
<url-pattern>*</url-pattern>
5452
</filter-mapping>
5553
```
5654

55+
This configuration applies HSTS consistently across specified web applications running on WSO2 Identity Server.
5756

5857
<!--## Enable for Jaggery applications
5958

0 commit comments

Comments
 (0)