> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flexagon.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Hardening options for FlexDeploy

> HTTP Strict Transport Security (HSTS) allows websites to declare that they can only be accessed via a secure connection (HTTPS). FlexDeploy enables or

HTTP Strict-Transport-Security (HSTS) allows websites to declare that they can only be accessed via a secure connection (HTTPS).

FlexDeploy enables or disables HSTS at Tomcat startup based on the `FLEXDEPLOY_HSTS` setting in `setenvoverride.sh` (Linux) or `setenvoverride.bat` (Windows). Edit that file under `<FlexDeploy Home>/apache-tomcat-flexdeploy/bin`, then restart Tomcat for the change to take effect.

**This is a one-time change.** Upgrade does not modify `setenvoverride.sh` / `setenvoverride.bat`, so your HSTS and cookie settings remain in place after upgrades.

By default, HSTS is disabled (HTTP connections are allowed).

* Set `FLEXDEPLOY_HSTS` to `1` to enable HSTS (HTTPS-only browser connections).

* Set `FLEXDEPLOY_HSTS` to `0` to disable HSTS (allows HTTP connections).

### Linux

In `setenvoverride.sh`, uncomment and set:

```
# Uncomment and set FLEXDEPLOY_HSTS to 1 to enable HSTS. This allows only HTTPS browser connections to work.
# Uncomment and set FLEXDEPLOY_HSTS to 0 to disable HSTS. This allows HTTP connections to work.
# Defaults to allowing http connections.
export FLEXDEPLOY_HSTS=1
```

### Windows

In `setenvoverride.bat`, uncomment and set:

```
@rem Uncomment and set FLEXDEPLOY_HSTS to 1 to enable HSTS. This allows only HTTPS browser connections to work.
@rem Uncomment and set FLEXDEPLOY_HSTS to 0 to disable HSTS. This allows HTTP connections to work.
@rem Defaults to allowing http connections.
set FLEXDEPLOY_HSTS=1
```

## Secure session cookies

If you enable HSTS, you should also set `FLEXDEPLOY_COOKIE_SECURE=1` in the same `setenvoverride` file so session cookies require HTTPS (or a load balancer using HTTPS).

### Linux

```
# Uncomment and set FLEXDEPLOY_COOKIE_SECURE to 1 to enable secure session cookies. This requires HTTPS, or a load balancer using HTTPS.
# Uncomment and set FLEXDEPLOY_COOKIE_SECURE to 0 to disable secure session cookies. This allows HTTP connections to work.
export FLEXDEPLOY_COOKIE_SECURE=1
```

### Windows

```
@rem Uncomment and set FLEXDEPLOY_COOKIE_SECURE to 1 to enable secure session cookies. This requires HTTPS, or a load balancer using HTTPS.
@rem Uncomment and set FLEXDEPLOY_COOKIE_SECURE to 0 to disable secure session cookies. This allows HTTP connections to work.
set FLEXDEPLOY_COOKIE_SECURE=1
```