Enabling HSTS Strict Transport Security via Sparkle for HTTP.SYS

BIZ TMS Sparkle
1

Hi, we're using Sparkle to implement an HTTP.SYS based web server application for Windows. We have limited the application in code to only support secure HTTPS connections. One of our customers has performed a security audit of the service, and reported that we are not including HSTS header(s) in our responses as described in RFC 6797. They view this as a potential vulnerability citing the potential for downgrade attacks, etc. notwithstanding our assurances that this is not possible since we explicitly ignore HTTP requests.

We've explored trying to enable HSTS globally for HTTP.SYS directly via the OS, but it does not appear to be possible. Is there a recommended means by which we can achieve this programatically through Sparkle?

2

You can simply use a generic middleware in your server to add the header yourself.

Just use a generic middleware and use its OnRequest event. Example:

procedure TForm1.XDataServer1GenericRequest(Sender: TObject; Context: THttpServerContext; Next: THttpServerProc);
begin
  Context.Response.OnHeaders(
    procedure(Response: THttpServerResponse)
    begin
      Response.Headers.SetValue('Strict-Transport-Security', 'max-age=63072000'); 
    end
  );

  Next(Context);
end;