article VA scan shows HSTS vulnerability for ActiveGate, Managed or OneAgent in Troubleshooting

VA scan shows HSTS vulnerability for ActiveGate, Managed or OneAgent

stefanie_pachne — Mon, 26 May 2025 08:29:57 GMT

Self Service Summary

Security Team is asking to "enable HSTS", is alerting that "HSTS is missing", "Strict Transport Security Not Enforced", or that the "Strict Transport Security header is not present in the response" for Dynatrace ActiveGate, Managed, RUM or OneAgent.

Issue	Solution	Tasks	Alternative(s)
Security concern regarding HSTS (HTTP Strict Transport Security) for ActiveGate, Managed or OneAgent	Explain that HSTS is not applicable here - see below	Check below information and explain it to your Security Team	Submit a support ticket if you need additional details or you face a different scenario

First of all, a quick recap of what the HSTS (HTTP Strict Transport Security) header is all about (taken from the RFC https://tools.ietf.org/html/rfc6797#section-2.2 or also explained on Wikipedia https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security).

If the HSTS header is set in an HTTPS response, the User Agent (= Browser) should from then on only use trusted HTTPS connections for all requests to the same host for the specified amount of time.

We do not support enabling HSTS on Dynatrace Managed cluster nodes or on ActiveGates.

HSTS is in general for public Internet servers, and in general, Dynatrace Managed cluster nodes are internal-only servers. User browsers should not be connecting directly to ActiveGates in most use cases, and certainly not as a primary connection.
Note: To avoid showing up in security scans, Dynatrace adds HSTS for those ActiveGate endpoints: Environment API v1, Environment API v2, Configuration API, State API (/rest/state, /rest/health).

RUM: Since ActiveGate v1.303 the HTTP response header Strict-Transport-Security is added to all beacon requests. For HTTP beacon requests, the header is ignored see Strict-Transport-Security - HTTP | MDN.

As a last remark, the Dynatrace OneAgent is not aware of the HTTP server/app server configuration, so it doesn't know if HSTS is generally enabled or not. The Agent cannot know for sure, because this header could potentially also be added on another network device (reverse proxy, load balancer,...).
For this reason, OneAgent cannot add this header as it would tell the HTTP client to only send requests via HTTPS to this site from then on. This could potentially break the web application if it's not designed to serve all requests via HTTPS.

Re: VA scan shows HSTS vulnerability for ActiveGate or Managed

ChadTurner — Wed, 21 Jun 2023 20:35:48 GMT

Thank you @stefanie_pachne for sharing this!

Re: VA scan shows HSTS vulnerability for ActiveGate or Managed

DanielS — Wed, 21 Jun 2023 21:19:28 GMT

Bookmarked, thanks for this.

Re: VA scan shows HSTS vulnerability for ActiveGate or Managed

Romanenkov_Al3x — Thu, 22 Jun 2023 07:13:41 GMT

Thanks for sharing.

Re: VA scan shows HSTS vulnerability for ActiveGate, Managed or OneAgent

IslamEsmail — Tue, 24 Sep 2024 07:11:01 GMT

thanks for sharing,

for more clarification, is there is any way to enable HSTS for Dynatrace managed cluster?

Re: VA scan shows HSTS vulnerability for ActiveGate, Managed or OneAgent

stefanie_pachne — Tue, 24 Sep 2024 07:59:37 GMT

@IslamEsmail

We consider this a false positive alert because HSTS is in general for public Internet servers. Dynatrace Managed cluster nodes are considered internal-only servers. Thus, we do not support enabling HSTS on Dynatrace Managed cluster nodes.

Does this help?

Re: VA scan shows HSTS vulnerability for ActiveGate, Managed or OneAgent

IslamEsmail — Tue, 24 Sep 2024 08:06:25 GMT

@stefanie_pachne

Thanks for clarification , and yes for me its help, lets see how it goes with the security geeks

Re: VA scan shows HSTS vulnerability for ActiveGate, Managed or OneAgent

AndrasKovacs — Wed, 30 Apr 2025 09:10:54 GMT

@stefanie_pachne: how about Cluster ActiveGates serving as the public endpoint? They receive mobile device traffic from the internet. If there is an upstream load balancer in front of them, then it is not a problem, if HSTS can not be enabled on those ActiveGates?

Re: VA scan shows HSTS vulnerability for ActiveGate, Managed or OneAgent

Zbigniew_Wroble — Mon, 12 May 2025 15:49:43 GMT

In AG 1.303, HSTS has been enabled on the RUM endpoints.