Express

HTTP Strict Transport Security is one of those headers you set once, then hopefully never think about again. That’s also why people get it wrong. For Express apps, HSTS looks deceptively simple: add a header and move on. But the real-world version has edge cases around reverse proxies, local development, subdomains, preload, and rollbacks. If you set preload too early, you can create a painful cleanup project for yourself. Here’s the practical guide I wish more teams followed. ...

HSTS is one of those headers that’s easy to enable and surprisingly easy to get wrong. If you run a REST API with Express, HSTS tells clients: “Stop trying plain HTTP for this host. Use HTTPS only for a while.” That sounds simple, but the details matter a lot in production, especially behind proxies, load balancers, and CDNs. This guide is the version I wish more API teams used: what to send, when to send it, and what not to do. ...

HSTS is one of those headers that’s dead simple on paper and weirdly easy to mess up in production. If you run a TypeScript app with tRPC, you usually don’t “add HSTS to tRPC” directly. You add it at the HTTP layer that serves your tRPC endpoint: Express, Fastify, Next.js custom server, Nginx, your edge platform, or your CDN. That distinction matters because if you set it in the wrong place, your API might still be exposed over plain HTTP during redirects or on subdomains you forgot existed. ...