# HSTS Missing From HTTPS Server (RFC 6797)

**URL:** <https://community.jenkins.io/t/hsts-missing-from-https-server-rfc-6797/7912>\
**Category:** Ask a question\
**Tags:** question\
**Created:** [June 8, 2023, 11:56pm UTC](https://community.jenkins.io/t/hsts-missing-from-https-server-rfc-6797/7912 "2023-06-08T23:56:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![noshini1](https://avatars.discourse-cdn.com/v4/letter/n/e99b99/32.png) [@noshini1](https://community.jenkins.io/u/noshini1)\
**Post date:** [June 8, 2023, 11:56pm UTC](https://community.jenkins.io/t/hsts-missing-from-https-server-rfc-6797/7912/1 "2023-06-08T23:56:30Z")

</div>

Hello,

I am looking to resolve the vulnerability " HSTS Missing From HTTPS Server (RFC 6797)" in Jenkins server. I have seen few recommendations to be done in web.xml file from Tomcat perspective. However, I need better clarity as Jenkins uses its own Java servlet container.  
Any help would be appreciated.

Thanks  
Noshini

---

<div class="post-metadata">

**Author:** ![halkeye](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/halkeye/32/8_2.png) [@halkeye](https://community.jenkins.io/u/halkeye)\
**Post date:** [June 12, 2023, 5:12am UTC](https://community.jenkins.io/t/hsts-missing-from-https-server-rfc-6797/7912/2 "2023-06-12T05:12:04Z")

</div>

My recommendation is to add a [reverse proxy](https://www.jenkins.io/doc/book/system-administration/reverse-proxy-configuration-with-jenkins/index.html) where you can add https/headers/etc.

You can do a lot of things to jenkins itself, but i always find managing https is a lot easier externally.

---

<div class="post-metadata">

**Author:** ![ayodeletolu12](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/ayodeletolu12/32/2797_2.png) [@ayodeletolu12](https://community.jenkins.io/u/ayodeletolu12)\
**Post date:** [February 15, 2024, 7:55pm UTC](https://community.jenkins.io/t/hsts-missing-from-https-server-rfc-6797/7912/3 "2024-02-15T19:55:24Z")

</div>

Hi, @noshini1 were you able to remediate this HSTS missing from HTTPS vulnerability? I am in the same shoes now. How were you able to enforce HTTP Strict Transport Security. My Jenkins run on Linux server.

Help will be appreciated

---

<div class="post-metadata">

**Author:** ![noshini1](https://avatars.discourse-cdn.com/v4/letter/n/e99b99/32.png) [@noshini1](https://community.jenkins.io/u/noshini1)\
**Post date:** [February 16, 2024, 2:25pm UTC](https://community.jenkins.io/t/hsts-missing-from-https-server-rfc-6797/7912/4 "2024-02-16T14:25:33Z")

</div>

Please try following this link and see if it works for you. I remember we added Strict transport security header in one of the xml files.  
[https://kinsta.com/knowledgebase/hsts-missing-from-https-server/#:~:text=Sometimes%2C%20an%20IT%20security%20scan,as%20a%20medium%2Drisk%20vulnerability](https://kinsta.com/knowledgebase/hsts-missing-from-https-server/#:~:text=Sometimes%2C%20an%20IT%20security%20scan,as%20a%20medium%2Drisk%20vulnerability).