All,
On 6/6/22 07:03, Anchal Sharma2 wrote:
Hi All,
After enabling SSL on apache solr using steps in solr
guide(https://solr.apache.org/guide/8_11/enabling-ssl.html) , we got below
vulnerability reported to us by our security team . Could someone please help
suggest how to resolve this for Solr v8.11.1?
VULNERABILITY -HSTS Missing From HTTPS Server (RFC 6797)
DESCRIPTION -The remote web server is not enforcing HSTS, as defined by RFC
6797. HSTS is an optional response header that can be configured on the server
to instruct the browser to only communicate via HTTPS. The lack of HSTS allows
downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens
cookie-hijacking protections.
SUGGESTED SOLUTION -Configure the remote web server to use HSTS.
Doesn't Solr run on one single port, anyway? Without significant effort,
it's not possible to have Solr accept both HTTP and HTTPS connections.
If you are using HTTPS, then congratulations, you are already using
HTTPS. If you are using HTTP, then HSTS is not relevant.
This seems like another case of a security evaluation not bothering to
understand anything about the use-case and instead making blanket
requirements that don't make any sense.
-chris
