tag: apache
Apache HTTP Server
Configuring Apache httpd in front of identity and API services: TLS, headers such as HSTS, and reverse-proxy restrictions.
Articles
- Information security
POODLE and the End of SSLv3, TLS 1.0 and TLS 1.1
How the 2014 POODLE attack broke SSLv3, why RFC 7568 and RFC 8996 later retired SSLv3, TLS 1.0 and 1.1, and which TLS settings to use for identity and API servers.
- Information security
Adding HSTS to PingFederate and Other Jetty-Based Servers
How to send Strict-Transport-Security from PingFederate and other Jetty-based servers: response header config files, Jetty rewrite rules, or a reverse proxy.
- Information security
Locking Down a Federation Server: Expose Only What You Must
How to shrink the attack surface of PingFederate or any federation server: separate admin and runtime, allowlist endpoints at the proxy, and add security headers.