Skip to main content
@Since 9.0.0.0 - This changed in the 9.0.0.0 release to be easier for customers and to allow doing it once and surviving across installer upgrades. HTTP Strict-Transport-Security (HSTS) allows websites to declare that they can only be accessed via a secure connection (HTTPS). FlexDeploy enables or disables HSTS at Tomcat startup based on the FLEXDEPLOY_HSTS setting in setenvoverride.sh (Linux) or setenvoverride.bat (Windows). Edit that file under <FlexDeploy Home>/apache-tomcat-flexdeploy/bin, then restart Tomcat for the change to take effect. This is a one-time change. Upgrade does not modify setenvoverride.sh / setenvoverride.bat, so your HSTS and cookie settings remain in place after upgrades. By default, HSTS is disabled (HTTP connections are allowed).
  • Set FLEXDEPLOY_HSTS to 1 to enable HSTS (HTTPS-only browser connections).
  • Set FLEXDEPLOY_HSTS to 0 to disable HSTS (allows HTTP connections).

​
Linux

In setenvoverride.sh, uncomment and set:

​
Windows

In setenvoverride.bat, uncomment and set:

​
Secure session cookies

If you enable HSTS, you should also set FLEXDEPLOY_COOKIE_SECURE=1 in the same setenvoverride file so session cookies require HTTPS (or a load balancer using HTTPS).

​
Linux

​
Windows