1

We are having a third party do security testing for our Salesforce community and one of their suggestions was to "utilize the "Strict-Transport-Security" response header across the entire domain as a security enhancement to instruct the browser to force all communication over HTTPS."

I've done some searching to see if Salesforce supports Strict Transport Security in their sites and communities but haven't seen any information. Is is possible to implement HSTS for Salesforce?

  • According to Salesforce, "Salesforce is not vulnerable even without HSTS. HSTS is only supported by some browser versions as it is a relatively new standard. We currently set our session cookies to HTTPS only, so the result is that customers cannot connect to their orgs via HTTP. " – Rochelle Jun 21 '16 at 19:19
1

I was digging the same thing and landed on this Query. Answering as this can be useful to somebody else.

Yes, its possible to implement HSTS for Salesforce.

It is enabled on all Salesforce and Visualforce pages, and it can’t be disabled. You can choose to enable HSTS on communities and Salesforce sites. When you enable HSTS on a subdomain, it’s also applied to the communities or Salesforce sites that share the subdomain.

Pls refer the below link that details the steps.

https://help.salesforce.com/articleView?id=browser_security.htm&type=5

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.