Hsts header
The Strict-Transport-Security header is an HTTP response header that instructs user agents to access a site only through HTTPS for a specified period.
ASP.NET Core in Action, 3e
HTTP Strict Transport Security is a web security policy that lets a site instruct browsers to use HTTPS for subsequent requests.
- How it is used
- Protects browser traffic by making HTTPS the required protocol for subsequent application requests.
- How deep it goes
- Explains browser behavior, deployment boundaries, middleware configuration, and preload options without detailing header parsing internals.
- Examples
- Uses ASP.NET Core HstsMiddleware with production gating, max-age configuration, preload, subdomains, and excluded hosts.
- What you can do after
- Configure ASP.NET Core HstsMiddleware for production and choose appropriate max-age, preload, and subdomain settings.
Building Web APIs with ASP.NET Core
An HTTP security policy that instructs browsers to access a site only over HTTPS.
- How it is used
- Deploys HSTS as a production web API security header that forces browser access through HTTPS.
- How deep it goes
- Defines the browser policy and shows its middleware call, but does not detail header directives or attack mechanics.
- Examples
- Uses an environment-conditional Program.cs pipeline containing app.UseHsts() in the non-development branch.
- What you can do after
- Operate/configure HSTS by enabling app.UseHsts() for the production web application pipeline.
Read how Building Web APIs with ASP.NET Core explains hsts header →
Real-World Cryptography
HSTS is an HTTP security policy mechanism that instructs a browser to access a website only over HTTPS for a specified period.
- How it is used
- Uses an HTTPS response header to move browser visits from HTTP toward HTTPS.
- How deep it goes
- Explains subsequent HTTPS enforcement and the unprotected first connection, but does not detail header directives or browser storage.
- Examples
- Uses an HTTP-to-HTTPS redirect and an attacker removing that redirect during the first connection.
- What you can do after
- Understand how HSTS reduces redirect-stripping risk after a browser has received the policy.
Grokking Web Application Security
HTTP Strict Transport Security is an HTTP security standard that instructs browsers to access a website only over HTTPS for a specified period.
- How it is used
- Enforces browser use of HTTPS as a practical defense against SSL-stripping and man-in-the-middle attacks.
- How deep it goes
- Explains browser policy and max-age, then stops short of broader HSTS options while showing an integrated NGINX configuration.
- Examples
- Uses one-week and one-year max-age headers plus an NGINX server configuration with an HTTP redirect and TLS 1.3.
- What you can do after
- Configure HSTS alongside HTTPS certificates, HTTP redirects, and secure server settings.
Read how Grokking Web Application Security explains hsts header →
.NET in Action, Second Edition
HTTP Strict Transport Security is a web security policy that tells browsers to access a site only through HTTPS.
- How it is used
- Protects production HTTPS deployments when HTTP requests are redirected or terminated by a proxy.
- How deep it goes
- Explains browser caching, threat reduction, environment selection, and ASP.NET Core activation, while deferring detailed header semantics.
- Examples
- Uses app.UseHsts() and AddHsts options for production activation and policy configuration.
- What you can do after
- Operate/configure ASP.NET Core services to emit HSTS only in suitable production environments.
Read how .NET in Action, Second Edition explains hsts header →
Related concepts
- HTTPSconfigures · HTTPS is HTTP carried over TLS, which provides encryption and endpoint authentication for network communication.
- security headerkind of · A security header is an HTTP response header that instructs a client, typically a browser, to apply a security-related protection or restriction.
- preload directiveincludes · The preload directive indicates that a site requests consideration for inclusion in browser HSTS preload data.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.