Application Center Web.config Settings

This page lists the customer-relevant settings in the Application Center Web.config file. The file is located in ..\<AMT environment>\AmtTools\ApplicationCenterCore\.

Custom Headers

The settings of this section have been added to increase security of the AMT Web applications.

With the exception of HSTS (see below), it is not advised to change these settings before consulting with the Avanade Customer Support via the Avanade Service Portal.

HTTP Strict Transport Security (HSTS)

By default, HSTS is not enabled in an AMT environment. To enable HSTS, uncomment the "Strict-Transport-Security" custom header in the web.config file, as shown below:

<customHeaders>
  <add name="Content-Security-Policy" value="..." />
  <!-- Remove to enforce HSTS communication -->
  <add name="Strict-Transport-Security" value="max-age=31536000" />

  <add name="X-Frame-Options" value="SAMEORIGIN" />
  ...
</customHeaders>

If you uncomment this section in the Application Center web.config file, also uncomment the same section in the Control Center web.config file.

Suppressing IIS server header

From IIS 10.0 onward, you can suppress the HTTP server header sent to clients.

This can be achieved by uncommenting the <security> node near the bottom of the web.config, making the node look like this:

<!--Remove the comments for security improvements for IIS 10-->
<security>
  <requestFiltering removeServerHeader="true" />
</security>

Redirect HTTP to HTTPS

Besides HSTS, the web.config also contains a section to redirect users from HTTP to HTTPS. To enable this functionality, install the IIS URL Rewrite module on the server that hosts the AMT applications (for example, Control Center, Application Center, and Web Client). The module can be downloaded from the Microsoft URL Rewrite website.

Once the IIS module is installed, the redirect functionality can be enabled by uncommenting the <rewrite> node near the bottom of the web.config, making the node look like this:

<rewrite>
  <rules>
    <rule name="Redirect HTTP to HTTPS" stopProcessing="true">
      <match url="(.*)" />
      <conditions>
        <add input="{HTTPS}" pattern="off" />
      </conditions>
      <action type="Redirect" url="https://{HTTP_HOST}/{R:443}" redirectType="Permanent" />
    </rule>
  </rules>
  <outboundRules>
    <rule name="Add the STS header in HTTPS responses">
      <match serverVariable="RESPONSE_Strict_Transport_Security" pattern=".*" />
      <conditions>
        <add input="{HTTPS}" pattern="on" />
      </conditions>
      <action type="Rewrite" value="max-age=31536000" />
    </rule>
  </outboundRules>
</rewrite>

If you uncomment this section in the Application Center web.config file, also uncomment the same section in the Control Center web.config file.