You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@solr.apache.org by Anchal Sharma2 <an...@in.ibm.com> on 2022/06/06 11:03:09 UTC
Vulnerability :HSTS Missing From HTTPS Solr server
Hi All,
After enabling SSL on apache solr using steps in solr guide(https://solr.apache.org/guide/8_11/enabling-ssl.html) , we got below vulnerability reported to us by our security team . Could someone please help suggest how to resolve this for Solr v8.11.1?
VULNERABILITY -HSTS Missing From HTTPS Server (RFC 6797)
DESCRIPTION -The remote web server is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections.
SUGGESTED SOLUTION -Configure the remote web server to use HSTS.
Thank you
Anchal Sharma
Re: Vulnerability :HSTS Missing From HTTPS Solr server
Posted by Christopher Schultz <ch...@christopherschultz.net>.
All,
On 6/6/22 07:03, Anchal Sharma2 wrote:
> Hi All,
>
> After enabling SSL on apache solr using steps in solr guide(https://solr.apache.org/guide/8_11/enabling-ssl.html) , we got below vulnerability reported to us by our security team . Could someone please help suggest how to resolve this for Solr v8.11.1?
>
> VULNERABILITY -HSTS Missing From HTTPS Server (RFC 6797)
>
> DESCRIPTION -The remote web server is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections.
>
> SUGGESTED SOLUTION -Configure the remote web server to use HSTS.
Doesn't Solr run on one single port, anyway? Without significant effort,
it's not possible to have Solr accept both HTTP and HTTPS connections.
If you are using HTTPS, then congratulations, you are already using
HTTPS. If you are using HTTP, then HSTS is not relevant.
This seems like another case of a security evaluation not bothering to
understand anything about the use-case and instead making blanket
requirements that don't make any sense.
-chris
Re: Vulnerability :HSTS Missing From HTTPS Solr server
Posted by Eric Pugh <ep...@opensourceconnections.com>.
There isn’t a commit yet, but https://issues.apache.org/jira/browse/SOLR-15578 was raised about adding this support.
> On Jun 6, 2022, at 7:25 AM, matthew sporleder <ms...@gmail.com> wrote:
>
> https://stackoverflow.com/questions/3009631/setting-http-headers-with-jetty
>
> On Mon, Jun 6, 2022 at 7:03 AM Anchal Sharma2 <an...@in.ibm.com> wrote:
>
>> Hi All,
>>
>> After enabling SSL on apache solr using steps in solr guide(
>> https://solr.apache.org/guide/8_11/enabling-ssl.html) , we got below
>> vulnerability reported to us by our security team . Could someone please
>> help suggest how to resolve this for Solr v8.11.1?
>>
>> VULNERABILITY -HSTS Missing From HTTPS Server (RFC 6797)
>>
>> DESCRIPTION -The remote web server is not enforcing HSTS, as defined by
>> RFC 6797. HSTS is an optional response header that can be configured on the
>> server to instruct the browser to only communicate via HTTPS. The lack of
>> HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and
>> weakens cookie-hijacking protections.
>>
>> SUGGESTED SOLUTION -Configure the remote web server to use HSTS.
>>
>> Thank you
>> Anchal Sharma
>>
_______________________
Eric Pugh | Founder & CEO | OpenSource Connections, LLC | 434.466.1467 | http://www.opensourceconnections.com <http://www.opensourceconnections.com/> | My Free/Busy <http://tinyurl.com/eric-cal>
Co-Author: Apache Solr Enterprise Search Server, 3rd Ed <https://www.packtpub.com/big-data-and-business-intelligence/apache-solr-enterprise-search-server-third-edition-raw>
This e-mail and all contents, including attachments, is considered to be Company Confidential unless explicitly stated otherwise, regardless of whether attachments are marked as such.
Re: Vulnerability :HSTS Missing From HTTPS Solr server
Posted by matthew sporleder <ms...@gmail.com>.
https://stackoverflow.com/questions/3009631/setting-http-headers-with-jetty
On Mon, Jun 6, 2022 at 7:03 AM Anchal Sharma2 <an...@in.ibm.com> wrote:
> Hi All,
>
> After enabling SSL on apache solr using steps in solr guide(
> https://solr.apache.org/guide/8_11/enabling-ssl.html) , we got below
> vulnerability reported to us by our security team . Could someone please
> help suggest how to resolve this for Solr v8.11.1?
>
> VULNERABILITY -HSTS Missing From HTTPS Server (RFC 6797)
>
> DESCRIPTION -The remote web server is not enforcing HSTS, as defined by
> RFC 6797. HSTS is an optional response header that can be configured on the
> server to instruct the browser to only communicate via HTTPS. The lack of
> HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and
> weakens cookie-hijacking protections.
>
> SUGGESTED SOLUTION -Configure the remote web server to use HSTS.
>
> Thank you
> Anchal Sharma
>