Does enabling HSTS in Spotfire Server have any impact on connections to Spotfire Statistics Services Server that uses only HTTP protocol?

Keywords:

Spotfire Server, Spotfire Statistics Services, HTTP Strict Transport Security, HSTS

Answer:

All data function communication with TIBCO Spotfire Statistics Services (TSSS) is direct communication between Spotfire clients (Analyst desktop client, Web Player, Automation Services) and TSSS instance, using the URL that TSSS instance is listening on. Spotfire Server is not involved in that communication path in any way, so there is no impact when Spotfire Server is using HSTS.

Additional details:

The Strict-Transport-Security HTTP header provides support for the HTTP Strict Transport Security (HSTS) standard, which helps to protect against protocol downgrade attacks and cookie hijacking by declaring that user agents, such as web browsers or Spotfire Analyst clients, must interact with the Spotfire Server using secure HTTPS connections:

https://docs.tibco.com/pub/spotfire_server/12.1.0/doc/html/TIB_sfire_server_tsas_admin_help/server/topics/http_strict-transport-security_(hsts).html