[jira] [Created] (AMBARI-25159) http.strict-transport-security change does not take affect in 2.7.x

[amarnath reddy pappu (JIRA)]

amarnath reddy pappu created AMBARI-25159:
---------------------------------------------

             Summary: http.strict-transport-security change does not take 
affect in 2.7.x
                 Key: AMBARI-25159
                 URL: https://issues.apache.org/jira/browse/AMBARI-25159
             Project: Ambari
          Issue Type: Bug
          Components: ambari-server
    Affects Versions: 2.7.3
            Reporter: amarnath reddy pappu


Updating the below configurations does not take affect in Ambari 2.7.x version


{noformat}
http.strict-transport-security=max-age=0
views.http.strict-transport-security=max-age=0
{noformat}

After setting the above configurations still API response gives below max-age 
headers.


{noformat}
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
{noformat}

I see AmbariServerSecurityHeaderFilter.java setting the correctly defined 
params but later somehow it is going to default value.

This works fine in 2.6.x versions.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)