GraphQL APIs usually get plenty of attention around auth, query depth limits, and introspection. Transport security often gets treated like a box to check: “we already use HTTPS.” That’s not enough. If your Apollo Server is reachable over plain HTTP, or if browsers can be tricked into making the first request insecurely, HTTPS alone leaves a gap. HSTS closes that gap for browser clients by telling them: from now on, only use HTTPS for this host. ...
HTTP Strict Transport Security sounds boring right up until you need it. HSTS is the header that tells browsers: “stop trying plain HTTP for this site, always use HTTPS.” That shuts down protocol downgrade attacks and removes a whole class of accidental insecure requests. If your site is on Cloudflare Pages, adding HSTS is easy. Adding it safely is the part people mess up. I’ve seen teams copy-paste max-age=31536000; includeSubDomains; preload into production without checking whether every subdomain actually supports HTTPS. That’s how you brick old marketing hosts and weird internal tools. ...
HTTP Strict Transport Security sounds simple: send one response header and browsers stop using HTTP for your site. In practice, Java teams still get it wrong. I’ve seen Spring Boot apps enable HSTS in one environment, forget it behind a reverse proxy, then wonder why production behavior doesn’t match local testing. If you run a Spring Boot app over HTTPS, HSTS is usually the right move. The real question is how to enable it, how aggressive to be, and when not to turn on the stricter options. ...
HSTS looks simple: send one header, force HTTPS, move on. That’s exactly why people mess it up. With AdonisJS, the mistakes usually aren’t about syntax. They’re about where the app sits in production, how TLS is terminated, whether subdomains are ready, and whether you’ve accidentally made local development annoying for everyone on the team. Here are the HSTS mistakes I see most often in AdonisJS apps, plus the fixes that actually work. ...
HTTP Strict Transport Security sounds simple: send one header, force HTTPS, move on. In production, it’s one of those settings that can either quietly protect your app for years or lock users into a broken setup because you flipped the wrong switch too early. If you run ASP.NET Core, HSTS is easy to enable. Getting it right takes a bit more care. What HSTS actually does HSTS tells the browser: ...
If you run a Phoenix app over HTTPS and you are not sending HSTS yet, you are leaving a pretty basic downgrade attack on the table. HSTS tells the browser: “Stop trying plain HTTP for this site. Use HTTPS only for a while.” That blocks SSL stripping and a bunch of accidental insecure requests after the first secure visit. Phoenix makes this easy, but there are a few sharp edges: ...
HTTP Strict Transport Security is one of those headers you set once, then hopefully never think about again. That’s also why people get it wrong. For Express apps, HSTS looks deceptively simple: add a header and move on. But the real-world version has edge cases around reverse proxies, local development, subdomains, preload, and rollbacks. If you set preload too early, you can create a painful cleanup project for yourself. Here’s the practical guide I wish more teams followed. ...
If you’re serving a Fiber app over HTTPS and you haven’t set HSTS yet, you’re leaving a pretty obvious gap in transport security. HSTS tells the browser: “stop trying plain HTTP for this site, always use HTTPS.” That blocks protocol downgrade attacks, strips out a whole class of SSL-stripping nonsense, and reduces accidental insecure requests from users who type example.com instead of https://example.com. For Go developers, the good news is that HSTS is just a response header. The bad news is that it’s also one of those headers that can lock users into a bad config if you ship it carelessly. ...
HSTS in FastAPI is one of those things that looks trivial until you ship it wrong. The header itself is simple: Strict-Transport-Security: max-age=31536000; includeSubDomains But the decision around where to set it, when to enable it, and whether to preload it can absolutely break local development, staging subdomains, and legacy services you forgot still exist. If you run FastAPI in production, you want HSTS. The real question is which implementation path fits your stack. ...
HSTS is one of those headers that’s easy to add and surprisingly easy to get wrong. If you run a Go app with Echo, you can enable it in a few lines. The hard part is choosing the right policy, rolling it out safely, and not locking yourself into a bad preload decision. This is the reference I wish more teams had handy. What HSTS does Strict-Transport-Security tells browsers: always use HTTPS for this site for a period of time you define optionally for all subdomains too optionally with preload eligibility A typical header looks like this: ...