## Expected Behavior Uchiwa supports HTTP Strict Transport Security (HSTS) as a mechanism for protecting against protocol downgrade attacks and cookie hijacking. ## Current Behavior Uchiwa does not implement HSTS policy mechanism. ## Context Lack of HSTS headers over HTTPS connections leaves Uchiwa instances vulnerable to protocol downgrade attacks and cookie hijacking. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security for reference. ## Your Environment <!--- Include as many relevant details about the environment you experienced the bug in --> * Uchiwa version used: 1.3.1 * Sensu version used: * Operating System and version (e.g. Ubuntu 14.04):
Expected Behavior
Uchiwa supports HTTP Strict Transport Security (HSTS) as a mechanism for protecting against protocol downgrade attacks and cookie hijacking.
Current Behavior
Uchiwa does not implement HSTS policy mechanism.
Context
Lack of HSTS headers over HTTPS connections leaves Uchiwa instances vulnerable to protocol downgrade attacks and cookie hijacking.
See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security for reference.
Your Environment