Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
Community Members
Community Events
Community Groups

Strict-Transport-Security header

All of our atlassian products are showing a vulnerability due to incorrectly configured Strict-Transport-Security header on the web servers.  I've found fixes for jira, and I'm assuming confluence.    But fisheye seems to be a different setting,  is there any way to adjust header without doing some kind of reverse proxy?

1 answer

0 votes
Daniel Eads Atlassian Team Aug 18, 2020

Hi Steve,

While a reverse proxy would be my first choice, you might have success modifying the config.xml file. Fisheye uses Jetty for its application server (vs Tomcat for Jira and Confluence), so the setup is different than other documentation you might use for other products.

Here's some discussion around adding the stsMaxAge value into a config.xml file for Jetty:

Note that this is untested on my end. Using a reverse proxy is typically how I'd recommend terminating SSL with Fisheye.


Suggest an answer

Log in or Sign up to answer

Atlassian Community Events