[FEATURE] Please provide a way to add "Strict-Transport-Security" header nativly.

[Gyges-of-lydia]

Dear Team,
in response to RFC 6797 (HSTS Missing From HTTPS Server) ,
We would like to have a native way to add restrictions in order to mitigite this potential vulnurability.
as of now the only solution is to put proxy/http server in front of it.

Example from Nussus report:

HSTS Missing From HTTPS Server (RFC 6797)

The remote web server is not enforcing HSTS, as defined by RFC 6797.
Plugin ID: 142960
IP address / Hostname:
1.1.1.1 / myserver
System administrator:

Port:
9200
Description
The remote web server is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections.
Output from most recent scan

WWW-Authenticate: Basic realm="OpenSearch Security"
X-OpenSearch-Version: OpenSearch/3.7.0 (opensearch)
content-type: text/plain; charset=UTF-8
content-length: 12

The remote HTTPS server does not send the HTTP
"Strict-Transport-Security" header.

Solution

Configure the remote web server to use HSTS.

opensearch-dashboards has this feature backed-in:
server.customResponseHeaders:
Strict-Transport-Security: "max-age=31536000; includeSubDomains"

many thanks in advance.