2

I have the following code-snippet for IIS.

<configuration>
 <system.webServer>
   <rewrite>
     <rules>
       <rule name="HTTPS_301_Redirect" stopProcessing="true">
         <match url="(.*)" />
         <conditions>
           <add input="{HTTPS}" pattern="^OFF$" />
         </conditions>
         <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" appendQueryString="false" redirectType="Permanent" />
       </rule>
     </rules>
     <outboundRules>
       <rule name="Add_HSTS_Header" preCondition="USING_HTTPS" patternSyntax="Wildcard">
         <match serverVariable="RESPONSE_Strict-Transport-Security" pattern="*" />
         <action type="Rewrite" value="max-age=31536000" />
       </rule>
       <preConditions>
         <preCondition name="USING_HTTPS">
           <add input="{HTTPS}" pattern="^ON$" />
         </preCondition>
       </preConditions>
     </outboundRules>
   </rewrite>
 </system.webServer>
</configuration>

Found here:

https://www.owasp.org/index.php/HTTP_Strict_Transport_Security

Q1: How do you know this is the correct syntax? RESPONSE underscore Server variable (from the code-snippet above)?

serverVariable="RESPONSE_Strict-Transport-Security"

Q2: Where can I find more info about it?

2 Answers 2

0

HTTP Strict Transport Security (HSTS) is a flag that a website can set so that all further communication from supported browsers will be forced to HTTPS.

In your configuration, the flag tells browsers to only use HTTPS for your site for at least the next year. This is done through an outbound rewrite rule that adds the HSTS header to all outbound responses.

As most users type in websites as www.example.com or example.com and not https://www.example.com, this is to help users avoid using unencrypted HTTP for communication.

1
  • Thanks for your answer. I know realize I formed my question wrong. I have updated it. What I am looking for is the explanation for that particular syntax RESPONSE underscore Server variable. Can't find any info on it. Commented Jun 9, 2015 at 20:26
0
serverVariable="RESPONSE_Strict-Transport-Security"

is just IIS URL Rewrite syntax that means, apply this rule to the response http header with the name Strict-Transport-Security

The module documentation explains this a little bit.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .