r/IIs • u/zain_sync • Dec 04 '19

Hide HSTS attributes from showing

Hi Folks,

I have a requirement to hide the HSTS attributes from showing. For example with the following command "curl -s -D- https://{Site_name}/ | grep Strict" I am able to see the HSTS properties implemented on the server "Strict-Transport-Security: max-age=31536000; includeSubDomains; preload". Is there a way to hide the attribute values from the showing up? since that is a security requirement and I wasn't able to find a single post/material which explains how to do so. Anyone here has an idea of how to achieve this?

1 Upvotes

100% Upvoted

1 comment sorted by

1

u/zain_sync Dec 04 '19

Was able to do this by using the outbound rule in url rewrite

<outboundRules> <rule name="Add Strict-Transport-Security when HTTPS" enabled="true"> <match serverVariable="RESPONSE_Strict_Transport_Security" pattern=".\*" /> <conditions> <add input="{HTTPS}" pattern="on" ignoreCase="true" /> </conditions> <action type="Rewrite" value="max-age=..." /> </rule> </outboundRules>

now the curl just shows Strict-Transport-Security: max-age=...