Hello,
Has anyone had success resolving: HSTS Missing From HTTPS Server (Nessus plugin 84502) for Bentley CAD License Management Web app?
On:
- Windows 2012r2 server (DVG-KSC-04)
- IIS 8
- HP vendor states it is a s/w (web) issue.
So we tried below in web.config to no avail. But we are not sure WHICH web.config to alter. Or should we just disable http 80 all together? Thanks.
<system.webServer>
<rewrite>
<rules>
<rule name="HTTP to HTTPS redirect" stopProcessing="true">
<match url="(.*)" />
<conditions>
<add input="{HTTPS}" pattern="off" ignoreCase="true" />
</conditions>
<action type="Redirect" url="https://{HTTP_HOST}/{R:1}"
redirectType="Permanent" />
</rule>
</rules>
<outboundRules>
<rule name="Add Strict-Transport-Security when HTTPS" enabled="true">
<match serverVariable="RESPONSE_Strict_Transport_Security"
pattern=".*" />
<add input="{HTTPS}" pattern="on" ignoreCase="true" />
<action type="Rewrite" value="max-age=31536000" />
</outboundRules>
</rewrite>