You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@trafficserver.apache.org by "Leif Hedstrom (JIRA)" <ji...@apache.org> on 2014/02/02 17:10:12 UTC

[jira] [Updated] (TS-1668) Traffic Server does currently not implement HSTS

     [ https://issues.apache.org/jira/browse/TS-1668?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Leif Hedstrom updated TS-1668:
------------------------------

    Issue Type: New Feature  (was: Bug)

> Traffic Server does currently not implement HSTS
> ------------------------------------------------
>
>                 Key: TS-1668
>                 URL: https://issues.apache.org/jira/browse/TS-1668
>             Project: Traffic Server
>          Issue Type: New Feature
>          Components: Security, SSL
>            Reporter: Igor Galić
>            Assignee: Bryan Call
>             Fix For: 4.2.0
>
>         Attachments: ts1688.diff, ts1688.diff
>
>
> Apache Traffic Server can be used as Reverse Proxy as well as for {{TLS}} ({{SSL}}) Termination for a huge number of sites.
> As such is the ideal point to implement [HTTP Strict Transport security|http://tools.ietf.org/html/rfc6797].
> I propose enable administrators to globally ({{records.config}}) configure HSTS for all sites that offer both, HTTP and HTTPS. (This switch, if backported, should default to off for stable releases.)
> We should further also make it possible to disable this setting per-site ({{ssl_multicert.config}}).



--
This message was sent by Atlassian JIRA
(v6.1.5#6160)