CODEWITHSUNDEEP
cashsts
Shyam
Shyam

Reputation: 11

Enable HSTS in CAS Web application

I have a CAS (Central Authentication Service) integrated web application. The default implementation of CAS webapp login (/cas/login) is not enforced with HSTS policy (Strict-Transport-Security). Except a custom authentication handler everything else is the default implementation being used in the project. So the question that i have is where to set the HSTS header in the response.

Please do help me in this regard. Thanks :)

Upvotes: 0

Views: 283

Answers (1)

Misagh Moayyed
Misagh Moayyed

Reputation: 4318

You don't mention what version CAS [which is something very useful], but in general HSTS is supported by CAS automatically provided you turn on settings that allow it to do so. Post back your version and I'll provide a link to the docs.

The job is handled via https://github.com/apereo/cas-server-security-filter internally.

Upvotes: 0

Related Questions