I have this very large and complex server application that amongst the numerous opensource tools that are baked into it, CouchDB 3.3.3 is one of them. “Baked” is important because what the vendor does is bake a stripped-down version of Couch it’s not a full install. As part of our application deployment all installs have to get security scanned and the security folks are bent out of shape over the port that Couch is configured on (29081 in this case, set in stone by the vendor of the app) not returning “Strict-Transport-Security” in the header. This app also includes Apache (which we are able to harden) and some of the traffic goes through Apache to Couch via that port hence the https part of this. Here’s the problem: I can access Couch via:

CURL>curl -X GET -u admin:password https://someserver:29081/_users

and even see that the databases exist:

CURL>curl -X GET -u admin:password https://someserver:29081/_all_dbs
["_replicator","_users","dsconfig$"]

But when I try

CURL>curl -X GET -u admin:password https://someserver:29081/settings/security/responseHeaders

Per https://docs.couchbase.com/server/current/rest-api/rest-setting-hsts.html I get

{"error":"not_found","reason":"Database does not exist."}

I’m also able to get to the Fauxton web interface but there appears to be no HSTS configuration section/setting that is obvious.