Python

HTTP Strict Transport Security, or HSTS, is one of those security headers that feels deceptively simple. Set one response header, ship it, done. Except that’s not really how it works in production. If you run a Django app and want HSTS configured properly, you need to understand what it actually does, how Django exposes it, and how to roll it out without accidentally breaking local development, subdomains, or a half-migrated environment. ...

HSTS in FastAPI is one of those things that looks trivial until you ship it wrong. The header itself is simple: Strict-Transport-Security: max-age=31536000; includeSubDomains But the decision around where to set it, when to enable it, and whether to preload it can absolutely break local development, staging subdomains, and legacy services you forgot still exist. If you run FastAPI in production, you want HSTS. The real question is which implementation path fits your stack. ...

A lot of backend teams assume HSTS is a “browser thing” that only matters for HTML pages. I’ve seen this mistake more than once on API-only services: the frontend is on HTTPS, the API is on HTTPS, everybody checks the box mentally, and nobody notices the API never sends Strict-Transport-Security. That gap usually survives until someone looks at headers closely, or until an auth callback, API docs page, or admin route gets hit over plain HTTP somewhere in the chain. ...