Configuring HSTS for HBase Web UIs

You can configure HBase to include HTTP headers to enforce the HTTP Strict Transport Security (HSTS) ensuring that a web browser does not load the service information using HTTP.

Additionally, all attempts to load the information using HTTP will automatically be converted to HTTPS.

Go to the HBase service.
Click the Configuration tab.
Select Advanced under Category.

Set the following HSTS credentials in HBase Service Advanced Configuration Snippet (Safety Valve) for hbase-site.xml.

<property>
<name>hbase.http.filter.hsts.value</name>
<value>max-age=63072000;includeSubDomains;preload</value>
</property>
<property>
<name>hbase.http.filter.csp.value</name>
<value>default-src https: data: 'unsafe-inline' 'unsafe-eval'</value>
</property>

Restart the HBase service.