Securing the application server by using HTTP Strict Transport Security (HSTS)
You can secure WebSphere® Application Server Network Deployment by adding STS response header for HTTPS requests at the web application level or at the server level. To enable HTTP Strict Transport Security (HSTS) at the web application level, set a web application context-parameter. To enable HSTS at the server level, set server level webcontainer custom property, or set up HSTS in IBM HTTP server, then set up IBM HTTP Server as a front end to WebSphere Application Server Network Deployment.
Securing a web application using a context parameter
com.ibm.ws.webcontainer.ADD_STS_HEADER_WEBAPPparam-name. (Note that the param-value provided here is an example.)
<context-param>
<param-name>com.ibm.ws.webcontainer.ADD_STS_HEADER_WEBAPP</param-name>
<param-value>max-age=31536000; includeSubDomains; preload</param-value>
</context-param>
<context-param>
<param-name>com.ibm.ws.webcontainer.ADD_STS_HEADER_WEBAPP</param-name>
<param-value>max-age=-1</param-value>
</context-param>
Securing the application server using HSTS in a web container custom property
com.ibm.ws.webcontainer.addStrictTransportSecurityHeader="max-age=31536000; includeSubDomains"
This configuration change requires an application server restart to take effect.
Securing the Deployment Manager
$ bin/wsadmin.sh -lang jython
dmgr = AdminConfig.getid("/Server:dmgr/")
webcontainer = AdminConfig.list("WebContainer", dmgr)
AdminConfig.create("Property", webcontainer, [["name", "com.ibm.ws.webcontainer.addStrictTransportSecurityHeader"],["value", "max-age=31536000; includeSubDomains"]])
AdminConfig.show(webcontainer)
AdminConfig.save()
The default port number is 9043. The deployment manager needs to be restarted for this configuration change to take effect.
Securing Node Agent SOAP Connector address ports
This SOAP port is used for internal interprocess communication and is not accessed by browsers that interpret HSTS headers. The default port number is 8880. Configuring HSTS is not applicable for this port, although direct security scans of this application server port may still report a false positive of missing HSTS headers.