Java

HTTP Strict Transport Security looks simple: send one header, browsers stop using HTTP, done. That’s the theory. In real Quarkus apps, HSTS usually goes wrong in boring, expensive ways: wrong environment, wrong proxy setup, bad preload assumptions, or turning it on before the whole domain is actually HTTPS-ready. If you’re building Java services with Quarkus, these are the mistakes I see most often and how to fix them without breaking production. ...

HTTP Strict Transport Security sounds simple: send one response header and browsers stop using HTTP for your site. In practice, Java teams still get it wrong. I’ve seen Spring Boot apps enable HSTS in one environment, forget it behind a reverse proxy, then wonder why production behavior doesn’t match local testing. If you run a Spring Boot app over HTTPS, HSTS is usually the right move. The real question is how to enable it, how aggressive to be, and when not to turn on the stricter options. ...