HTTP Strict-Transport-Security Header in Liferay

Issue

• Is HTTP Strict-Transport-Security Header enabled in Liferay?

Environment

• Liferay DXP 7.4

Resolution

• Liferay enables HTTP security headers such as 'http.header.secure.x.content.type.options', 'http.header.secure.x.xss.protection', 'http.header.secure.x.content.type.options' by default.
• The HTTP Strict-Transport-Security Header is not enabled in Liferay as the required configuration should be performed on an Application Server like Tomcat or the WebServer like Apache.
• However, there is a feature request for enabling the HSTS Header at Liferay's end. Please refer to the LPS-39213 and can vote on the LPS, so that if the feature is implemented you will come to know.

Additional Information

• Does Liferay DXP 7.1 support HTTP headers?
• Introduction to Securing Liferay DXP
• Why certain Security Headers are not included in the HTTP Request and Response of Liferay DXP
• HTTP Strict Transport Security (HSTS) Header Not Used
• How to enable HSTS (This is an unofficial article and use of this article is completely at your discretion)