recon.sh
← back to report
info

Strict-Transport-Security header not set on www.acme.dev

https://www.acme.dev/

CWE-523category config

description

Responses from `www.acme.dev` do not include a `Strict-Transport-Security` header. A network attacker positioned between the user and the server can downgrade subsequent requests to HTTP and intercept session cookies. HSTS preloading is also not configured.

evidence

Request

GET / HTTP/1.1
Host: www.acme.dev

Response

HTTP/1.1 200 OK
Content-Type: text/html
(no Strict-Transport-Security header)

reproduction steps

  1. Issue `curl -I https://www.acme.dev/` and observe the absence of an HSTS header.

remediation

`Strict-Transport-Security: max-age=63072000; includeSubDomains; preload` on every HTTPS response. Submit to hstspreload.org once every subdomain serves HTTPS.

rotate the credentials you provided.

we ran the scan with the credentials you supplied. treat them as compromised and rotate now.

couldn't reproduce this finding?

if it does not reproduce from the evidence above, you get back what this finding cost you: its credits for a credit unlock, or a cash refund for a finding bought through our earlier per-finding checkout. see how claims work, or email team@recon.sh with finding ID f8 and scan ID sample.