New HTTP security response header for AdminUI

Detail name	Value
Changelog Number	25312
Type	Improvement
Status	Resolved
Fix Versions	Exasol 8.29.12, C4 4.28.4, Exasol 2025.1.4, Exasol 2025.2.0
Resolution Date	2025-09-15

Background

Admin UI server uses internal HTTP API on port 8443.

Improvement

The following new HTTP security response header has been added to the HTTP API of the Admin UI server by c4 server, running on port 8443:

Strict-Transport-Security: max-age=31536000; includeSubDomains

This HTTP header will prevent the browser from interpreting files as a different MIME type to what is specified in the Content-Type HTTP header.

Changed behavior

AdminUI API responses will now contain Strict-Transport-Security header. This change will not be visible to AdminUI WebGUI users (only API requests).