Enable HSTS in hybris port 9002

[Former Member]

When I access https://localhost:9002/hac or https://localhost:9002/backoffice, HTTP Strict Transport Security (HSTS) is not in the response header.

Any one know where to add this in hybris?

[pavan_joshi1]

You should include a new security filter in the BackOffice flow using web-fragments, which will be merged from all *backoffie extensions.

>> BackofficeSecurityHeaderFilter.java

New filter class with below code : 
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException
{
      HttpServletResponse response = (HttpServletResponse) servletResponse;
      response.addHeader("Strict-Transport-Security", "max-age=31556926; includeSubDomains");

      filterChain.doFilter(servletRequest, response);
}

>> resources/web-fragment.xml

<web-fragment xmlns="http://java.sun.com/xml/ns/javaee"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="
        http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-fragment_3_0.xsd";
	version="3.0">
	<name>webfragment_BackofficeSecurityHeaderFilter</name>
	<filter>
		<filter-name>BackofficeSecurityHeaderFilter</filter-name>
		<filter-class><package>.BackofficeSecurityHeaderFilter</filter-class>
		<async-supported>true</async-supported>
	</filter>
	<filter-mapping>
		<filter-name>BackofficeSecurityHeaderFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
</web-fragment>