Summary 

This Knowledgebase article provides information about how to enable HTTP Strict-Transport-Security (HSTS)  in Continuity Engine Management Service

Procedure

To enable HTTP Strict-Transport-Security (HSTS):

On the Engine Management Server:

1. Stop Neverfail Engine Management Web Services service. 
2. Open in a text editor the configuration file "C:\Program Files\Neverfail\tomcat\apache-tomcat-x.x.xx\conf\web.xml"
3. Search for the httpHeaderSecurity filter and modify/update the values like this (make sure you also uncomment the filter):
1. ...edit

   ...edit

   <filter>
   <filter-name>httpHeaderSecurity</filter-name>
   <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
   <async-supported>true</async-supported>
   <init-param>
   <param-name>hstsEnabled</param-name>
   <param-value>true</param-value>
   </init-param>
   <init-param>
   <param-name>hstsMaxAgeSeconds</param-name>
   <param-value>31536000</param-value>
   </init-param>
   <init-param>
   <param-name>hstsIncludeSubDomains</param-name>
   <param-value>true</param-value>
   </init-param>
   </filter>
    
   
4. Localize the “httpHeaderSecurity“ filter-mapping section and uncomment it. Resulting text should be like this:
   
1. ...edit

   ...edit

   <filter-mapping>
   <filter-name>httpHeaderSecurity</filter-name>
   <url-pattern>/*</url-pattern>
   <dispatcher>REQUEST</dispatcher>
   </filter-mapping>

    
   
5. Save the file and start the Neverfail Engine Management Web Services service. 
   
6. The edited settings will add in the EMS API response headers the following 3 values:

   
   
1. 
   

Applies to 

Neverfail Continuity Engine Management Service up to v15