# Continuing the discussion from \[Strict-Transport-Security for opendistro\](https://forum.opensearch.org/t/strict-transport-security-for-opendistro/4823)

**URL:** <https://forum.opensearch.org/t/continuing-the-discussion-from-strict-transport-security-for-opendistro-https-forum-opensearch-org-t-strict-transport-security-for-opendistro-4823/21152>\
**Category:** Security\
**Tags:** configure, feature-request, security-issue\
**Created:** [September 5, 2024, 8:18am UTC](https://forum.opensearch.org/t/continuing-the-discussion-from-strict-transport-security-for-opendistro-https-forum-opensearch-org-t-strict-transport-security-for-opendistro-4823/21152 "2024-09-05T08:18:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jmeher](https://avatars.discourse-cdn.com/v4/letter/j/b3f665/32.png) [@jmeher](https://forum.opensearch.org/u/jmeher)\
**Post date:** [September 5, 2024, 8:18am UTC](https://forum.opensearch.org/t/continuing-the-discussion-from-strict-transport-security-for-opendistro-https-forum-opensearch-org-t-strict-transport-security-for-opendistro-4823/21152/1 "2024-09-05T08:18:35Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
OpenSearch: 1.3 and 2.15

**Describe the issue** :  
I am facing the issue with Strict-Transport-Security (HSTS), Missing Security Headers Security header from Open Search.

Is there any way to set custom headers for Open Search port or any other feasible solution available from Open search to address this HSTS security concern.

Note : This is not the problem with curl only, this issue is response from Open Search to any of the requested client. Need a common solution from server.

Please Help! Thanks in Advance.

Regards,  
J Meher

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [September 11, 2024, 8:51pm UTC](https://forum.opensearch.org/t/continuing-the-discussion-from-strict-transport-security-for-opendistro-https-forum-opensearch-org-t-strict-transport-security-for-opendistro-4823/21152/2 "2024-09-11T20:51:16Z")

</div>

Hi @jmeher ,

I have found a topic in the Github with a similar issue. Please take a look at the following discussion:

> <https://github.com/opensearch-project/OpenSearch/issues/1069>
>
> The objective of this feature is to provide a configuration open in opensearch.y…ml to enable the server to send custom HTTP response headers.
> 
> The option can be defined as shown below:
> http.custom.headers: \["Strict-Security-Transport:max-age=31536000; includeSubDomains;"\]
> 
> Running this "curl -v -u admin:admin http://localhost:9200" command would return the below bold header in the HTTP response. (The below response is coming from Elasticsearch but the same is expected with OpenSearch)
> \* Rebuilt URL to: http://localhost:9200/
> \* Trying ::1...
> \* TCP\_NODELAY set
> \* Connected to localhost (::1) port 9200 (#0)
> \* Server auth using Basic with user 'admin'
> \> GET / HTTP/1.1
> \> Host: localhost:9200
> \> Authorization: Basic YWRtaW46YWRtaW4=
> \> User-Agent: curl/7.55.1
> \> Accept: \*/\*
> \>
> \< HTTP/1.1 200 OK
> \< \_\*\*Strict-Security-Transport: max-age=31536000; includeSubDomains;\*\*\_
> \< content-type: application/json; charset=UTF-8
> \< content-length: 506
> \<
> {
> "name" : "LAPTOP-C0J5I3L2",
> "cluster\_name" : "elasticsearch",
> "cluster\_uuid" : "xVUOVOAGR4iaNHA2AEv1pw",
> "version" : {
> "number" : "7.8.0",
> "build\_flavor" : "oss",
> "build\_type" : "zip",
> "build\_hash" : "unknown",
> "build\_date" : "2021-02-16T10:30:42.633581400Z",
> "build\_snapshot" : false,
> "lucene\_version" : "8.5.1",
> "minimum\_wire\_compatibility\_version" : "6.8.0",
> "minimum\_index\_compatibility\_version" : "6.0.0-beta1"
> },
> "tagline" : "You Know, for Search"
> }

According to the documentation [here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security), HSTS header is a hit for browsers do not use http. Redirection from HTTP to HTTPS creates an opportunity for a man-in-the-middle attack.

Usually, OpenSearch Dashboards is used in a browser. you can add a custom header for OpenSearch Dashboards as in the example below:

> <https://github.com/opensearch-project/OpenSearch-Dashboards/issues/5307#issuecomment-1895458096>
>
> \*\*Is your feature request related to a problem? Please describe.\*\*
> 
> The Opense…arch-Dashboards HTTPS server is not enforcing HTTP Strict Transport Security (HSTS).
> The responses from the server therefore do not have "Strict-Transport-Security" header.
> 
> 
> \*\*Describe the solution you'd like\*\*
> 
> A solution to this issue would be to add a parameter in \*opensearch-dashboard.yml\* with the purpose to add "Strict-Transport-Security" header in all the HTTP responses.