HTTP Strict Transport Security (HSTS) Header Not Used

Issue

• The HSTS header cannot completely defend against man-in-the-middle attacks. However, it can be useful in defending against an attack in which an attacker establishes an encrypted connection to the application and presents an unencrypted fraudulent service to the user. This is because the presence of the HSTS header would ensure the user’s browser would not use the unencrypted service, provided the user has previously visited the site without outside interference. 

Environment

• Liferay DXP 7.2

Resolution

• There is no out-of-the-box feature to help you achieve this requirement. However, there is a feature request for the same. Please refer to the LPS-39213 for the same.
  
  If you go through the above-mentioned LPS, it is mentioned that this is achievable through an appropriate Apache configuration or any other frontend webserver. However, you can vote on the LPS, so if the feature is implemented you will come to know. 
  
  In addition to the above, LPS-39213, there is a plugin mentioned to achieve the same. You can refer to that plugin as well. Please find the link below:
  https://web.liferay.com/marketplace/-/mp/application/27551660
  
  Please Note:
  1) The above plugin is mentioned for the Liferay version 6.2. However, you can refer to the source code mentioned in the LPS and create the same for Liferay DXP 7.2.
  
  Also, with the Third-party like Web server, creating a plugin falls beyond the scope of Liferay Support. However, if you want our assistance on the same, you can approach our Global Services Team because giving development ideas comes within the scope of the Global Services team. This team can be contacted through your sales representative, so if you want to avail of this service I would suggest you contact the sales team to know more about this.