# Enable HSTS on the web portal

**URL:** <https://discourse.openondemand.org/t/enable-hsts-on-the-web-portal/1161>\
**Category:** Get Help\
**Tags:** feature-request, question\
**Created:** [October 13, 2020, 8:17pm UTC](https://discourse.openondemand.org/t/enable-hsts-on-the-web-portal/1161 "2020-10-13T20:17:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vnegrea](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/vnegrea/32/1333_2.png) [@vnegrea](https://discourse.openondemand.org/u/vnegrea)\
**Post date:** [October 13, 2020, 8:17pm UTC](https://discourse.openondemand.org/t/enable-hsts-on-the-web-portal/1161/1 "2020-10-13T20:17:02Z")

</div>

Hello,

I was looking for a way to enable HSTS (HTTP Strict Transport Security).

I can modify the portal **ood-portal.conf.erb** and get it working that way but that doesn’t seem like a reliable solution when doing updates to new versions.

Is there a place that I am not seeing where I can enable HSTS and if not can this be add as an option that can be enabled via the ood\_portal.yml file?

Thanks  
Vasile

---

<div class="post-metadata">

**Author:** ![efranz](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/efranz/32/27_2.png) [@efranz](https://discourse.openondemand.org/u/efranz)\
**Post date:** [October 14, 2020, 12:33am UTC](https://discourse.openondemand.org/t/enable-hsts-on-the-web-portal/1161/2 "2020-10-14T00:33:03Z")

</div>

Since OnDemand doesn’t currently provide a way for arbitrary Apache config items, an alternative to modifying ood-portal.conf.erb would be to set the header globally. If no services being served by that Apache instance ever will require http and can always be https, or the only purpose of this Apache instance is to serve OnDemand, you could try adding a file like /opt/rh/httpd24/root/etc/httpd/conf.d/strict\_security\_transport.conf with the contents:

```auto
Header set Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

```

Meanwhile I’m going to look at a modification ensuring this is set by default in a 1.8 patch release this month (but that would specifically apply to the OnDemand VirtualHost.

---

<div class="post-metadata">

**Author:** ![vnegrea](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/vnegrea/32/1333_2.png) [@vnegrea](https://discourse.openondemand.org/u/vnegrea)\
**Post date:** [October 14, 2020, 3:38pm UTC](https://discourse.openondemand.org/t/enable-hsts-on-the-web-portal/1161/3 "2020-10-14T15:38:11Z")

</div>

> [@vnegrea](#):
>
> HTTP Strict Transport Security)

Thank you, I like the solution you recommended and it makes it into the 1.8 that would be great.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [May 19, 2022, 1:58pm UTC](https://discourse.openondemand.org/t/enable-hsts-on-the-web-portal/1161/4 "2022-05-19T13:58:46Z")

</div>

Closed on May 19, 2022, 1:58pm UTC

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.