Hi, after a security test in our project it was requested, that we add Strict-Tranport-Security-Header to our application responses. How would i do that in conjunction with uaa? I have found the config to add x-content-type and content-security-policy-sources but nothing else.
On another note: Is it possible to add x-content-type and content-security-policy to the response we get when loading the application (in our case when we call localhost:8082/index.html for example)?
Thanks in advance,
Nick
Hi Nick,
do you use fullstack A12 application?
Josef
Depending on your reverse-proxy you should configure it there, because this normally terminates your tls connection.
Yes we have fullstack A12. 
I will give @stefan-cold-haze answer a try.
I have forwarded it to our DevOps guys. I will update when/if they implement it. This could probably take some time tho.
Dear @nick-linked-tensor
was the response helpful and is the issue now solved or are there some additional questions? If it is solved, please, use the checkbox to mark the solution to your problem so that other users also know what helped to your case.
All the best
from the Discourse team
It was solved through our DevOps colleague and works as required. 