HSTS for Python with Flask: Setup, Pitfalls, and Testing
HSTS is one of those headers that looks trivial until you ship it wrong. For Flask apps, the basic idea is simple: tell browsers to always use HTTPS for your domain. That blocks protocol downgrade attacks and kills off a whole class of “accidentally served over HTTP” mistakes. But HSTS also has sharp edges. If you enable it too early, on the wrong host, or behind a misconfigured proxy, you can lock users into a broken site. ...