A penetration tester reports an application is only utilizing basic authentication on an Internet- facing application. Which of the following would be the BEST remediation strategy?

HSTS is a security policy delivered via the Strict-Transport-Security response header that instructs browsers to refuse HTTP connections and always use HTTPS. This ensures basic authentication credentials are always transmitted over an encrypted TLS channel, and prevents man-in-the-middle actors from forcing a downgrade to HTTP where the base64-encoded credentials would be exposed in plaintext.

The secure cookie flag protects session cookies from being sent over non-HTTPS connections, but does not address the exposure of credentials transmitted in the Authorization header by basic authentication.

Simply adding TLS to the channel is a partial mitigation, but without HSTS enforcement a downgrade attack or misconfigured client can still initiate an HTTP connection that exposes basic auth credentials.

Sanitizing user input defends against injection attacks such as XSS or SQL injection and has no bearing on the transmission security of credentials sent via the basic authentication mechanism.