(1) MEDIUM - Missing_HSTS_Header

[TiagoV-PDMFC]

implement HSTS headers for the API

[joaoluis-pdm]

Just my 2 cents: The FGT services operate entirely in HTTP (not HTTPS), as it normally operates on port 8080 (not 443).
It is up to the surrounding infrastructure, if desired to have the service reverse-proxied by HTTPS, to add the HSTS header (if desired).

[joaoluis-pdm]

Reponse proposal: The code is designed for http (not https). Makes no sense to add an Strict-Transport-Security header on an http response in this situation. When deploying a production environment, the solution will probably be wrapped by a reverse https-to-http proxy. It is up to that proxy to add the Strict-Transport-Security header if desired.