freeipa

#9899 Header Strict-Transport-Security (HSTS) is not set
Opened by snegrini. Modified

Open
Close Issue

During a recent OWASP ZAP scan of the FreeIPA WebUI, a low-risk configuration issue was identified.
The application is currently not setting the Strict-Transport-Security header. This omission allows for potential downgrade attacks, where an attacker could exploit a user's initial connection to force the browser to use insecure HTTP instead of the required HTTPS, exposing the connection to various man-in-the-middle attacks.

CWE: CWE-319: Cleartext Transmission of Sensitive Information

Recommendation
Configure the web server to include the HSTS header with an appropriate configuration, i.e. Strict-Transport-Security: max-age=31536000; includeSubDomains; preload.
This configuration instructs the browser to communicate with the site only over HTTPS for the next year, including all subdomains, and optionally prepares the domain for HSTS preloading.

This is incorrect suggestion. We expose OCSP as well and OCSP responder is available over port 80, intentionally by the OCSP specification. Setting HSTS will not allow browsers to communicate with the responder. See https://https.cio.gov/guide/#are-federally-operated-certificate-revocation-services-crl-ocsp-also-required-to-move-to-https for details.

Access to FreeIPA resources is enforced over https already by the webserver configuration. In particular, any authenticated endpoint for IPA API refuses non-HTTPS operations.

Additionally, we have no control over the domain exposed for IPA deployment. We simply cannot commit to HSTS on behalf of the administrators for the whole private domain.

Metadata Update from @dhanina:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/IDM-1569

@abbra Is there a specific reason why we expose 80? Do we actually need that port for something or is this only because of the specification?

@dhanina yes, see my comment above yours'. ;) OCSP must be over port 80 by the specification. Also, ACME challenge http-01 can only be done over port 80.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.