1

I have the following code-snippet for IIS.

<configuration>
 <system.webServer>
   <rewrite>
     <rules>
       <rule name="HTTPS_301_Redirect" stopProcessing="true">
         <match url="(.*)" />
         <conditions>
           <add input="{HTTPS}" pattern="^OFF$" />
         </conditions>
         <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" appendQueryString="false" redirectType="Permanent" />
       </rule>
     </rules>
     <outboundRules>
       <rule name="Add_HSTS_Header" preCondition="USING_HTTPS" patternSyntax="Wildcard">
         <match serverVariable="RESPONSE_Strict-Transport-Security" pattern="*" />
         <action type="Rewrite" value="max-age=31536000" />
       </rule>
       <preConditions>
         <preCondition name="USING_HTTPS">
           <add input="{HTTPS}" pattern="^ON$" />
         </preCondition>
       </preConditions>
     </outboundRules>
   </rewrite>
 </system.webServer>
</configuration>

Found here:

https://www.owasp.org/index.php/HTTP_Strict_Transport_Security

Q1: How do you know this is the correct syntax? RESPONSE underscore Server variable (from the code-snippet above)?

serverVariable="RESPONSE_Strict-Transport-Security"

Q2: Where can I find more info about it?

0

HTTP Strict Transport Security (HSTS) is a flag that a website can set so that all further communication from supported browsers will be forced to HTTPS.

In your configuration, the flag tells browsers to only use HTTPS for your site for at least the next year. This is done through an outbound rewrite rule that adds the HSTS header to all outbound responses.

As most users type in websites as www.example.com or example.com and not https://www.example.com, this is to help users avoid using unencrypted HTTP for communication.

  • Thanks for your answer. I know realize I formed my question wrong. I have updated it. What I am looking for is the explanation for that particular syntax RESPONSE underscore Server variable. Can't find any info on it. – PussInBoots Jun 9 '15 at 20:26
0
serverVariable="RESPONSE_Strict-Transport-Security"

is just IIS URL Rewrite syntax that means, apply this rule to the response http header with the name Strict-Transport-Security

The module documentation explains this a little bit.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.