Security Hardening options for FlexDeploy

HTTP Strict-Transport-Security (HSTS) allows websites to declare that they can only be accessed via a secure connection (HTTPS). FlexDeploy enables or disables HSTS at Tomcat startup based on the FLEXDEPLOY_HSTS setting in setenvoverride.sh (Linux) or setenvoverride.bat (Windows). Edit that file under <FlexDeploy Home>/apache-tomcat-flexdeploy/bin, then restart Tomcat for the change to take effect. When enabled, FlexDeploy toggles the HSTS filter in Tomcat’s root conf/web.xml (<FlexDeploy Home>/apache-tomcat-flexdeploy/conf/web.xml). That applies the Strict-Transport-Security header at the server root (/) and for all applications, not only under the FlexDeploy web context. @Since 11.1.0.4 This is a one-time change. Upgrade does not modify setenvoverride.sh / setenvoverride.bat, so your HSTS and cookie settings remain in place after upgrades. By default, HSTS is disabled (HTTP connections are allowed).

Set FLEXDEPLOY_HSTS to 1 to enable HSTS (HTTPS-only browser connections).
Set FLEXDEPLOY_HSTS to 0 to disable HSTS (allows HTTP connections).

Linux

In setenvoverride.sh, uncomment and set:

# Uncomment and set FLEXDEPLOY_HSTS to 1 to enable HSTS via root conf/web.xml. This allows only HTTPS browser connections to work.
# Uncomment and set FLEXDEPLOY_HSTS to 0 to disable HSTS. This allows HTTP connections to work.
# Defaults to allowing http connections.
 export FLEXDEPLOY_HSTS=1

Windows

In setenvoverride.bat, uncomment and set:

@rem Uncomment and set FLEXDEPLOY_HSTS to 1 to enable HSTS via root conf/web.xml. This allows only HTTPS browser connections to work.
@rem Uncomment and set FLEXDEPLOY_HSTS to 0 to disable HSTS. This allows HTTP connections to work.
@rem Defaults to allowing http connections.
set FLEXDEPLOY_HSTS=1

Secure session cookies

If you enable HSTS, you should also set FLEXDEPLOY_COOKIE_SECURE=1 in the same setenvoverride file so session cookies require HTTPS (or a load balancer using HTTPS).

Linux

# Uncomment and set FLEXDEPLOY_COOKIE_SECURE to 1 to enable secure session cookies. This requires HTTPS, or a load balancer using HTTPS.
# Uncomment and set FLEXDEPLOY_COOKIE_SECURE to 0 to disable secure session cookies. This allows HTTP connections to work.
 export FLEXDEPLOY_COOKIE_SECURE=1

Windows

@rem Uncomment and set FLEXDEPLOY_COOKIE_SECURE to 1 to enable secure session cookies. This requires HTTPS, or a load balancer using HTTPS.
@rem Uncomment and set FLEXDEPLOY_COOKIE_SECURE to 0 to disable secure session cookies. This allows HTTP connections to work.
set FLEXDEPLOY_COOKIE_SECURE=1

FlexDeploy 11.1 Documentation

​Linux

​Windows

​Secure session cookies

​Linux

​Windows

Linux

Windows

Secure session cookies

Linux

Windows