Strict-Transport-Security header

[stevezohn]

All of our atlassian products are showing a vulnerability due to incorrectly configured Strict-Transport-Security header on the web servers.  I've found fixes for jira, and I'm assuming confluence.    But fisheye seems to be a different setting,  is there any way to adjust header without doing some kind of reverse proxy?

[Daniel Eads]

Hi Steve,

While a reverse proxy would be my first choice, you might have success modifying the config.xml file. Fisheye uses Jetty for its application server (vs Tomcat for Jira and Confluence), so the setup is different than other documentation you might use for other products.

Here's some discussion around adding the stsMaxAge value into a config.xml file for Jetty:

https://issues.sonatype.org/browse/NEXUS-20268

Note that this is untested on my end. Using a reverse proxy is typically how I'd recommend terminating SSL with Fisheye.

Cheers,
Daniel