The security tab in developer console shows HSTS as disabled whereas we see all the response header under "Headers" tab
We recently implemented HSTS in our webapplication where using filter we send the HSTS headers back to browser. When we check any URL after logging in, we see the relevant HSTS response headers confirming that we have done the implementation correctly. But when we check the security tab, it shows "HSTS" as "Disabled".
How is browser determining that "HSTS" (HTTP Strict Transport Security) is disabled?
All Replies (4)
If you have visited the website before then there might be a record in SiteSecurityServiceState.txt in the profile folder.
Can you post a link to a publicly accessible page (i.e. no authentication or signing on required)?
Can you attach a screenshot?
- https://support.mozilla.org/en-US/kb/how-do-i-create-screenshot-my-problem
- use a compressed image type like PNG or JPG to save the screenshot
I have attached the screen shot for the Response headers from the "Headers" tab and the screen shot from "Security" tab which shows "HSTS" as disabled.
Unfortunately I cannot share the link for the application as it is within the internal network and not accessible from outside.
Modified by subodh.natu
Did you check the SiteSecurityServiceState.txt file?
Yes I checked the "SiteSecurityServiceState.txt", it doesn't have that domain listed in the file.
I even created a new profile and accessed the site using the new profile, even then the domain doesn't show up in the new file.