CloudLink: 원격 HTTPS 서버가 HSTS(HTTP Strict Transport Security)를 적용하고 있지 않습니다.

CloudLink: 보안 검사 보고서:

The remote HTTPS server is not enforcing HTTP Strict Transport Security (HSTS)
The remote HTTPS server does not send the HTTP "Strict-Transport-Security" header

HSTS는 HTTPS를 통해서만 통신하도록 브라우저에 지시하도록 서버에서 구성할 수 있는 선택적 응답 헤더입니다. HSTS가 없기 때문에 다운그레이드 공격, SSL 스트리핑 메시지 가로채기(man-in-the-middle) 공격이 허용되고 쿠키 하이재킹 보호가 약화됩니다.

- Navigate to the Cloudlink UI login page.
- Right click on white empty space and select 'Inspect'.
- Select the 'Network' tab.
- Select one of the Cloudlink HTTP requests on the left panel.
- Match the response headers you're seeing to what we expect to see from the KB article

HTTP 응답에는 모든 헤더가 있으며 기본적으로 https://docs.spring.io/autorepo/docs/spring-security/4.2.3.RELEASE/reference/html/headers.html

            HTTP/1.1 200 OK
            Date: Fri, 22 May 2020 11:51:57 GMT
            Cache-Control: no-cache, no-store, max-age=0, must-revalidate
            Pragma: no-cache
            Expires: Thu, 01 Jan 1970 00:00:00 GMT
            Strict-Transport-Security: max-age=31536000 ; includeSubDomains
            X-XSS-Protection: 1; mode=block
            X-Frame-Options: SAMEORIGIN
            X-Content-Type-Options: nosniff
            Content-Type: text/html
            Last-Modified: Tue, 10 Sep 2019 17:33:22 GMT
            Accept-Ranges: bytes
            Vary: Accept-Encoding, User-Agent
            ETag: W/"C/NxCAz49KYC/NwZBDEXzM"
            Content-Length: 1349