False positive - HSTS in RSA Authentication Manager 8.5
This article applies to RSA Authentication Manager 8.5.
Vulnerability scan found HSTS vulnerabilities.
Alert Impact Explanation
This is not an actual exploitable vulnerability with HSTS and RSA Authentication Manager web services. In case of Authentication Manager we do not use HTTP anywhere in the system, so even enabling HSTS should not make any difference.
HSTS is about ensuring HTTPS is used for web browser connections, and RSA Authentication Manager forces this to be true by default. Adding HSTS response headers will not change much in this regard.
The RSA Authentication Manager web applications, if they allow HTTP at all, redirect immediately to HTTPS. Therefore, any advantage of implementing HSTS in its current state and format will not change the possibility that the first packet is HTTP. Therefore, it is reasonable to say that there is no added risk on the RSA Authentication Manager Web Tier servers to not deploying HSTS that would be removed by implementing or enforcing it.