HSTS in ASP.NET Core: Practical Setup and Gotchas
HTTP Strict Transport Security sounds simple: send one header, force HTTPS, move on. In production, it’s one of those settings that can either quietly protect your app for years or lock users into a broken setup because you flipped the wrong switch too early. If you run ASP.NET Core, HSTS is easy to enable. Getting it right takes a bit more care. What HSTS actually does HSTS tells the browser: ...