HTTP Strict Transport Security (HSTS) tells browsers that a site is accessible only through HTTPS by returning the Strict-Transport-Security response header. Browsers cache this policy for the whole site, avoiding repeated HTTP requests and reducing exposure before an HTTP redirect can arrive. section 9.3
Enable HSTS only where its long-term browser-caching behavior is appropriate:
- Avoid HSTS in frequently changing alpha, beta, or preproduction environments unless they match your production policy. section 9.3
Production-only activation
var app = builder.Build(); if (app.Environment.IsProduction()) { app.UseHsts(); }
