HTTPS

HTTP Strict Transport Security

As a part of secure web store communications, Sana supports HTTP Strict Transport Security (HSTS). This is the header which is added to the Web server responses to disallow insecure HTTP connection for the entire web store domain, when a Sana web store is running over HTTPS.

When Sana is running over HTTPS, it sends HSTS header in all responses to the Web browser which come via HTTPS connection. Once the Web browser receives this header, it will prevent any communications from being sent over HTTP to the specified domain, and will instead send all communications over HTTPS.

When you enable HTTPS, Sana will start sending HSTS header automatically with the default values.

This is how HSTS header looks like when it is sent to the Web browser:

Strict-Transport-Security: max-age=31536000; includeSubDomains

If the "preload" directive is enabled, the HSTS header will look like this:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

You can change the HSTS header settings in the "Web.config" file of the Sana Commerce Frontend.

<ssl mode="Full" hstsMaxAge="31536000" hstsIncludeSubDomains="true" hstsPreload="false" />

The table below provides description of the attributes which are used to set up HSTS header behavior.