Strict-Transport-Security header not set on 404 pages

[dsotirho-ucsc]

ZAP scan finding
Severity: Low

HTTP Strict Transport Security (HSTS) is a web security policy mechanism whereby a web server declares that complying user agents (such as a web browser) are to interact with it using only secure HTTPS connections (i.e. HTTP layered over TLS/SSL). HSTS is an IETF standards track protocol and is specified in RFC 6797.

Example:

• https://data.humancellatlas.org/favicon.ico (404 page)

Solution:

Ensure that your web server, application server, load balancer, etc. is configured to enforce Strict-Transport-Security.

[achave11-ucsc]

Duplicate of https://github.com/DataBiosphere/azul-private/issues/81, which we closed as won't fix.