HTTP Strict Transport Security (HSTS) is a security policy that instructs browsers to use HTTPS for all subsequent requests to an application. After receiving a valid HSTS header over HTTPS, a browser upgrades http:// requests to https:// automatically. section 28.4 section 28.4.1
Use HSTS with these practical boundaries:
- Send the header only in an HTTPS response; it affects browser requests, not server-to-server communication or mobile apps. section 28.4.1
- Enable HSTS for production sites that always intend to use HTTPS, but generally leave it disabled during local development. section 28.4.1
- Combine HSTS with HTTP-to-HTTPS redirection because HSTS takes effect only after the browser has made an initial HTTPS request. section 28.5
- Treat enforcement as difficult to undo; use preload, subdomains, and long max-age values only when the entire site is ready for HTTPS. section 28.4.1
Configure HSTS in ASP.NET Core
Register HstsMiddleware settings and enable it only in production: builder.Services.AddHsts(options => { options.MaxAge = TimeSpan.FromHours(1); }); then use if (app.Environment.IsProduction()) { app.UseHsts(); }. The default max-age is 30 days; the example changes it to one hour.
