title: How to set the strict transport security header for jetty 9.2.25
body: <p>Am trying to add strict transport security header for my jetty server 9.2.25</p>
  
  <p>I have tried to add the rule to my jetty-config.xml, but it seems not working.</p>
  
  <pre><code> &lt;Get id="oldhandler" name="handler"/&gt;
      &lt;Set name="handler"&gt;
        &lt;New id="Rewrite" class="org.eclipse.jetty.rewrite.handler.RewriteHandler"&gt;
          &lt;Set name="handler"&gt;
             &lt;Ref id="oldhandler"/&gt;
          &lt;/Set&gt;
          &lt;Set name="rewriteRequestURI"&gt;true&lt;/Set&gt;
          &lt;Set name="rewritePathInfo"&gt;false&lt;/Set&gt;
          &lt;Set name="originalPathAttribute"&gt;requestedPath&lt;/Set&gt;
  
          &lt;Call name="addRule"&gt;
              &lt;Arg&gt;
                  &lt;New class="org.eclipse.jetty.rewrite.handler.HeaderPatternRule"&gt;
                      &lt;Set name="pattern"&gt;/*&lt;/Set&gt;
                      &lt;Set name="name"&gt;Strict-Transport-Security&lt;/Set&gt;
                      &lt;Set name="value"&gt;max-age=31536000;includeSubDomains&lt;/Set&gt;
                  &lt;/New&gt;
              &lt;/Arg&gt;
          &lt;/Call&gt;
        &lt;/New&gt;
      &lt;/Set&gt;
  </code></pre>
  
  <p>To check if it is working, I tried to see the curl output, its not displaying the Strict-Transport-Security information.
  Actually, it should display the below line in the curl output.</p>
  
  <p>Strict-Transport-Security: max-age=31536000; includeSubDomains</p>
  
  <p>root@ip:~#curl -k --head <a href="https://ip:443" rel="nofollow noreferrer">https://ip:443</a></p>
  
  <p>HTTP/1.1 200 OK</p>
  
  <p>X-Frame-Options: DENY</p>
  
  <p>Content-Type: text/html;charset=UTF-8</p>
  
  <p>Set-Cookie: JSESSIONID=157bfeip315gbmb796uh2yq4m;Path=/;Secure</p>
  
  <p>Expires: Thu, 01 Jan 1970 00:00:00 GMT</p>
  
  <p>Pragma: no-cache</p>
  
  <p>Cache-Control: no-store</p>
  
  <p>Content-Length: 8246</p>
  
  <p>Server: Jetty(9.2.25.v20180606)</p>
  
  <p>please let me know if any changes are needed in this config/Any other way to configure the jetty web server for adding HSTS header.</p>
  
  <p>Thanks for your help.</p>