If you run a Phoenix app over HTTPS and you are not sending HSTS yet, you are leaving a pretty basic downgrade attack on the table. HSTS tells the browser: “Stop trying plain HTTP for this site. Use HTTPS only for a while.” That blocks SSL stripping and a bunch of accidental insecure requests after the first secure visit. Phoenix makes this easy, but there are a few sharp edges: ...
HTTP Strict Transport Security is one of those headers you set once, then hopefully never think about again. That’s also why people get it wrong. For Express apps, HSTS looks deceptively simple: add a header and move on. But the real-world version has edge cases around reverse proxies, local development, subdomains, preload, and rollbacks. If you set preload too early, you can create a painful cleanup project for yourself. Here’s the practical guide I wish more teams followed. ...
If you’re serving a Fiber app over HTTPS and you haven’t set HSTS yet, you’re leaving a pretty obvious gap in transport security. HSTS tells the browser: “stop trying plain HTTP for this site, always use HTTPS.” That blocks protocol downgrade attacks, strips out a whole class of SSL-stripping nonsense, and reduces accidental insecure requests from users who type example.com instead of https://example.com. For Go developers, the good news is that HSTS is just a response header. The bad news is that it’s also one of those headers that can lock users into a bad config if you ship it carelessly. ...
HSTS in FastAPI is one of those things that looks trivial until you ship it wrong. The header itself is simple: Strict-Transport-Security: max-age=31536000; includeSubDomains But the decision around where to set it, when to enable it, and whether to preload it can absolutely break local development, staging subdomains, and legacy services you forgot still exist. If you run FastAPI in production, you want HSTS. The real question is which implementation path fits your stack. ...
HSTS is one of those headers that’s easy to add and surprisingly easy to get wrong. If you run a Go app with Echo, you can enable it in a few lines. The hard part is choosing the right policy, rolling it out safely, and not locking yourself into a bad preload decision. This is the reference I wish more teams had handy. What HSTS does Strict-Transport-Security tells browsers: always use HTTPS for this site for a period of time you define optionally for all subdomains too optionally with preload eligibility A typical header looks like this: ...
HTTP Strict Transport Security sounds simple: send one response header and browsers stop using plain HTTP for your domain. With AWS API Gateway, it’s a little messier. The short version: API Gateway can return Strict-Transport-Security, but whether HSTS actually helps depends on how clients reach your API, whether you use a custom domain, and whether any HTTP endpoint still exists in front of it. If you only remember one thing, remember this: HSTS protects browser traffic for hostnames, not APIs in the abstract. If your API is consumed by server-to-server clients, mobile apps, or SDKs, HSTS is mostly irrelevant. If your API is called from browser-based apps on a custom domain, then it absolutely matters. ...
HSTS in Ktor is simple once you know where to put it, and easy to get wrong if you treat it like just another header. Strict-Transport-Security tells browsers: “for this domain, use HTTPS only for a while.” After a browser sees it over a valid HTTPS response, future HTTP requests get upgraded to HTTPS before they ever leave the browser. That blocks protocol downgrade attacks and strips out a whole class of sloppy redirect problems. ...
HSTS is one of those headers that’s easy to enable and surprisingly easy to get wrong. If you run a REST API with Express, HSTS tells clients: “Stop trying plain HTTP for this host. Use HTTPS only for a while.” That sounds simple, but the details matter a lot in production, especially behind proxies, load balancers, and CDNs. This guide is the version I wish more API teams used: what to send, when to send it, and what not to do. ...
If you run APIs over HTTPS, HSTS looks like an easy win. Set one header, tell clients to never use HTTP again, and reduce downgrade and cookie leakage risks. That’s the sales pitch. For browser-facing traffic, I’m generally a fan. For API endpoints, the answer is more nuanced. HSTS absolutely helps in some API deployments, does almost nothing in others, and can create operational headaches if you roll it out carelessly. ...
HSTS is one of those headers that’s dead simple on paper and weirdly easy to mess up in production. If you run a TypeScript app with tRPC, you usually don’t “add HSTS to tRPC” directly. You add it at the HTTP layer that serves your tRPC endpoint: Express, Fastify, Next.js custom server, Nginx, your edge platform, or your CDN. That distinction matters because if you set it in the wrong place, your API might still be exposed over plain HTTP during redirects or on subdomains you forgot existed. ...