Skip to main content

HTTP Strict Transport Security (HSTS)

In the v24.1 SLM release, we added support for HSTS to improve web security. To configure HSTS, follow these steps:

  1. Locate the appsettings.json file (default path: C:\Program Files\OpenLM\OpenLM Server\bin).

    File Explorer showing the appsettings.json file in the OpenLM Server bin folder.

  2. Find the HTTPSRequestsRedirectionEnabled parameter (added after installation or upgrade) and set it to true to enable HSTS.

    appsettings.json with the HTTPSRequestsRedirectionEnabled parameter set to true.

  3. Add an HTTPS section in the Kestrel Endpoint with the SSL link, following the SSL setup guide. Choose a port different from the standard HTTP port.

    Kestrel Endpoints section in appsettings.json with both HTTP and HTTPS entries.

To disable HSTS, revert the HTTPSRequestsRedirectionEnabled parameter to false and remove the added HTTPS section.

note

The HTTP section must always be present in the file for the OpenLM SLM to function properly, regardless of whether the address is SSL-secured or not.

Last updated on by Maria Gilca