We recently had a Burp Suite scan done and it found that "BurpSuite Found: 'Strict transport security not enforced' (Type: 16777984)" To correct the issue, below is what was suggested:- "The application should instruct web browsers to only access the application using HTTPS. To do this, enable HT…

HTTP strict Transport Security

Marius_Dragomir (Marius Dragomir) March 22, 2019, 11:44am 2

Hello,
You can try and achieve this by using the server.customResponseHeaders https://www.elastic.co/guide/en/kibana/current/settings.html and specifying your own custom one.
The format for the setting is like this: Format of kibana server.customResponseHeaders

Topic		Replies	Views
Security Header Elasticsearch	8	1444	October 1, 2020
Added HTTP Security Headers in Kibana Config *.yml File, but it's not reflection in the server please help me Kibana	3	2276	February 22, 2019
Kibana http requests instead of https? i.e. without encryption Kibana	5	1514	July 6, 2017
[KIBANA][Rules and Connectors] You must enable Transport Layer Security Kibana elastic-stack-security , elastic-stack-alerting	5	2053	September 14, 2021
About the content security policies Kibana elastic-stack-security	0	192	June 14, 2024