AD FS and HSTS about windowsserverdocs HOT 2 CLOSED

We will close this issue now. Please reopen if you would like additional follow-up.

from windowsserverdocs.

We will close this issue now. Please reopen if you would like additional follow-up.

Issue has not been addressed, nor can I re-open a closed issue myself. I don't see why you've closed it.

The page here https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/customize-http-security-headers-ad-fs still misses the point and erroneously states:

As a result, AD FS effectively mitigates the threats that HTTP Strict Transport Security policy mechanism provides (by default there is no downgrade to HTTP since there are no listeners in HTTP).

This was incorrect in 2017, and it's still incorrect today. The threat isn't mitigated by having no HTTP listeners, since the whole point is to protect against an active MitM (which can respond to the SYN on port 80 and then the browser will treat the server as if it did have an HTTP listener!).

Maybe it would be easier if I just opened a PR?

from windowsserverdocs.