# Insecure HTTP headers

**URL:** <https://community.auth0.com/t/insecure-http-headers/8926>\
**Category:** Get Help\
**Tags:** security-issue\
**Created:** [December 8, 2017, 11:57pm UTC](https://community.auth0.com/t/insecure-http-headers/8926 "2017-12-08T23:57:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![carsten.mueller.lemb](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@carsten.mueller.lemb](https://community.auth0.com/u/carsten.mueller.lemb)\
**Post date:** [December 8, 2017, 11:57pm UTC](https://community.auth0.com/t/insecure-http-headers/8926/1 "2017-12-08T23:57:09Z")

</div>

During our security review we figured out that.  
Response header is exposing technology used:

```
server:nginx

```

Strict transport layer security and other headers are missing:

```
Strict-Transport-Security:max-age=15552000; includeSubDomains
X-DNS-Prefetch-Control:off
X-XSS-Protection:1; mode=block

```

---

<div class="post-metadata">

**Author:** ![jmangelo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jmangelo/32/7923_2.png) [@jmangelo](https://community.auth0.com/u/jmangelo)\
**Post date:** [December 11, 2017, 8:07pm UTC](https://community.auth0.com/t/insecure-http-headers/8926/2 "2017-12-11T20:07:15Z")

</div>

The HSTS header should be there although at this time it does not include the sub-domains option. In relation to the other situations you should update the question with the relevant endpoints that you tested and where you observed each behavior.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 2, 2018, 5:57am UTC](https://community.auth0.com/t/insecure-http-headers/8926/3 "2018-03-02T05:57:42Z")

</div>