HSTS Missing From HTTPS Server

[priboyano]

Hello,

We have identified the following vulnerability on our Proxmox VE web interface:

HSTS Missing From HTTPS Server (RFC 6797)

Is there an officially supported way to configure the Strict-Transport-Security (HSTS) HTTP header directly in pveproxy?

We could not find a documented native configuration option for this.

If there is no supported way to configure it, is using a reverse proxy the recommended approach?

Also, if we manually modify pveproxy or its underlying configuration to add the HSTS header, would this be considered a supported configuration and would the changes be preserved after updates?

We need this information to address the finding and provide evidence to our Compliance team.

Thank you!

 

[longer]

See:

Post in thread 'Enabling HSTS'

Sep 15, 2022

Hi,
I don't think there is a built-in way for that. You can create an enhancement request for PVE [1]. The alternative would be some proxy server that sets that for you. See the guide in the wiki [2].


[1] https://bugzilla.proxmox.com/enter_bug.cgi?product=pve
[2] https://pve.proxmox.com/wiki/Web_Interface_Via_Nginx_Proxy
[3] https://forum.proxmox.com/threads/nginx-reverse-proxy-with-novnc-support.52165/

• shrdlicka

 

[longer]

If you have a requirement to implemented, then maybe you can try as mention in the aforementioned thread:
"
The alternative would be some proxy server that sets that for you. See the guide in the wiki [2].
[2] https://pve.proxmox.com/wiki/Web_Interface_Via_Nginx_Proxy
"