3

We are having a third party do security testing for our Salesforce community and one of their suggestions was to "utilize the "Strict-Transport-Security" response header across the entire domain as a security enhancement to instruct the browser to force all communication over HTTPS."

I've done some searching to see if Salesforce supports Strict Transport Security in their sites and communities but haven't seen any information. Is is possible to implement HSTS for Salesforce?

Improve this question
1
  • According to Salesforce, "Salesforce is not vulnerable even without HSTS. HSTS is only supported by some browser versions as it is a relatively new standard. We currently set our session cookies to HTTPS only, so the result is that customers cannot connect to their orgs via HTTP. "
    – Rochelle
    Commented Jun 21, 2016 at 19:19

1 Answer 1

Reset to default
2

I was digging the same thing and landed on this Query. Answering as this can be useful to somebody else.

Yes, its possible to implement HSTS for Salesforce.

It is enabled on all Salesforce and Visualforce pages, and it can’t be disabled. You can choose to enable HSTS on communities and Salesforce sites. When you enable HSTS on a subdomain, it’s also applied to the communities or Salesforce sites that share the subdomain.

Pls refer the below link that details the steps.

https://help.salesforce.com/articleView?id=browser_security.htm&type=5

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .