Add HTTP Strict Transport Security (HSTS)

HTTP Strict Transport Security (HSTS) allows web servers to declare that any web browser should only use an HTTPS connection to interact with it. This helps in securing the website against protocol downgrade attacks and cookie hijacking. It is a recommended configuration for any HTTPS installation of AVEVA Information Standards Manager.

Important: This must not be done for HTTP installations.

To enable this header for each request, add the following configuration to the <customHeaders> node under <system.webServer> of your web.config file:

<httpProtocol>
<customHeaders>
<add name="Strict-Transport-Security" value="max-age=31536000"/>
</customHeaders>
</httpProtocol>