Hello,
Trying to fix HSTS (aka Strict-Transport-Security) by creating Custom Headers under Advanced configuration of SSRS 2019. Prior versions did not support custom headers. Currently, based on this link https://docs.microsoft.com/en-us/sql/reporting-services/tools/server-properties-advanced-page-reporting-services?view=sql-server-ver15 , did create following custom headers since we have standard reports urls which are https://servername/reports and https://servername/reportserver :
<CustomHeaders>
<Header>
<Name>
Strict-Transport-Security
</Name>
<Pattern>(.+)\/Reports\/(.+)
</Pattern>
<Value>max-age=31536000; includeSubDomains=true
</Value>
</Header>
</CustomHeaders>
However, with the above only https://servername/reports shows strict transport security (HSTS) when I look at the developer tools from the browser (any browser such as Edge or Chrome), but not https://server/reportserver url. I tried changing the pattern matching to <Pattern>(.+)\/Report\/(.+)</Pattern> and it still does not work. I tried few other combinations as well.
Will greatly appreciate if you can provide the correct custom header pattern matching to use so that both the SSRS urls pages are rendered using HSTS which complies with our new security requirements.
Thanks.
Victor
