Enabling HSTS on FlexDeploy (Tomcat) - Flexagon Documentation

HTTP Strict-Transport-Security (HSTS) allows websites to declare that they can only be accessed via a secure connection (HTTPS). FlexDeploy enables or disables HSTS at Tomcat startup based on the FLEXDEPLOY_HSTS setting in setenvoverride.sh (Linux) or setenvoverride.bat (Windows). Edit that file under <FlexDeploy Home>/apache-tomcat-flexdeploy/bin, then restart Tomcat for the change to take effect. This is a one-time change. Upgrade does not modify setenvoverride.sh / setenvoverride.bat, so your HSTS setting remains in place after upgrades. By default, HSTS is disabled (HTTP connections are allowed).

Set FLEXDEPLOY_HSTS to 1 to enable HSTS (HTTPS-only browser connections).
Set FLEXDEPLOY_HSTS to 0 to disable HSTS (allows HTTP connections).

Linux

In setenvoverride.sh, uncomment and set:

# Uncomment and set FLEXDEPLOY_HSTS to 1 to enable HSTS. This allows only HTTPS browser connections to work.
# Uncomment and set FLEXDEPLOY_HSTS to 0 to disable HSTS. This allows HTTP connections to work.
# Defaults to allowing http connections.
export FLEXDEPLOY_HSTS=1

Windows

In setenvoverride.bat, uncomment and set:

@rem Uncomment and set FLEXDEPLOY_HSTS to 1 to enable HSTS. This allows only HTTPS browser connections to work.
@rem Uncomment and set FLEXDEPLOY_HSTS to 0 to disable HSTS. This allows HTTP connections to work.
@rem Defaults to allowing http connections.
set FLEXDEPLOY_HSTS=1

If you enable HSTS, you should also set FLEXDEPLOY_COOKIE_SECURE=1 in the same setenvoverride file so session cookies require HTTPS (or a load balancer using HTTPS).

FlexDeploy 10.0 Documentation

​Linux

​Windows

Linux

Windows