CloudLink: The remote HTTPS server is not enforcing HTTP Strict Transport Security (HSTS)

Summary: CloudLink: Security scan reports"The remote HTTPS server is not enforcing HTTP Strict Transport Security (HSTS)"

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

CloudLink: Security scan reports:

The remote HTTPS server is not enforcing HTTP Strict Transport Security (HSTS)
The remote HTTPS server does not send the HTTP "Strict-Transport-Security" header

HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate using HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-inthe-middle attacks, and weakens cookie-hijacking protections.

Cause

This appears to be a false-alarm reported by the security tool.

HSTS is enabled by default on CloudLink. 
To confirm, view the CloudLink HTTP headers in Chrome, do the following: 
- Navigate to the Cloudlink UI login page.
- Right click on white empty space and select 'Inspect'.
- Select the 'Network' tab.
- Select one of the Cloudlink HTTP requests on the left panel.
- Match the response headers you're seeing to what we expect to see from the KB article

Resolution

The HTTP Response has all the headers and is set by-default by https://docs.spring.io/autorepo/docs/spring-security/4.2.3.RELEASE/reference/html/headers.html

            HTTP/1.1 200 OK
            Date: Fri, 22 May 2020 11:51:57 GMT
            Cache-Control: no-cache, no-store, max-age=0, must-revalidate
            Pragma: no-cache
            Expires: Thu, 01 Jan 1970 00:00:00 GMT
            Strict-Transport-Security: max-age=31536000 ; includeSubDomains
            X-XSS-Protection: 1; mode=block
            X-Frame-Options: SAMEORIGIN
            X-Content-Type-Options: nosniff
            Content-Type: text/html
            Last-Modified: Tue, 10 Sep 2019 17:33:22 GMT
            Accept-Ranges: bytes
            Vary: Accept-Encoding, User-Agent
            ETag: W/"C/NxCAz49KYC/NwZBDEXzM"
            Content-Length: 1349

Affected Products

CloudLink SecureVM, CloudLink
Article Properties
Article Number: 000181096
Article Type: Solution
Last Modified: 09 Feb 2026
Version:  5
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.