Security-Headers

HTTP Strict Transport Security sounds boring right up until you need it. HSTS is the header that tells browsers: “stop trying plain HTTP for this site, always use HTTPS.” That shuts down protocol downgrade attacks and removes a whole class of accidental insecure requests. If your site is on Cloudflare Pages, adding HSTS is easy. Adding it safely is the part people mess up. I’ve seen teams copy-paste max-age=31536000; includeSubDomains; preload into production without checking whether every subdomain actually supports HTTPS. That’s how you brick old marketing hosts and weird internal tools. ...

HSTS is one of those headers that looks trivial until you ship it wrong. For Flask apps, the basic idea is simple: tell browsers to always use HTTPS for your domain. That blocks protocol downgrade attacks and kills off a whole class of “accidentally served over HTTP” mistakes. But HSTS also has sharp edges. If you enable it too early, on the wrong host, or behind a misconfigured proxy, you can lock users into a broken site. ...

HSTS and service workers overlap in ways that bite teams during deployment, local testing, and incident response. The short version: HSTS tells the browser to always use HTTPS for a host. Service workers only work in secure contexts, with a few localhost exceptions. If you get your HTTPS and redirect behavior wrong, service worker registration gets flaky fast. If you get HSTS wrong, rollback gets painful because browsers cache the policy. I’ve seen teams debug “random” service worker failures that were really bad TLS, mixed hostnames, or a stale HSTS policy. This guide is the practical version. ...

HTTP Strict Transport Security sounds simple: send one response header, force browsers onto HTTPS, done. In practice, the hard part is deciding where to manage it in Kong and how aggressively to roll it out without breaking edge cases. If you run Kong API Gateway, you usually have a few choices: Set HSTS in Kong itself Set HSTS in an upstream app behind Kong Set HSTS at an outer load balancer or CDN instead of Kong Use a phased rollout with short max-age first, then increase later I’m opinionated on this one: if Kong is your main HTTPS entry point, HSTS usually belongs there. It keeps policy consistent across services and avoids every team reinventing the same header logic. But there are trade-offs, and some teams absolutely should not flip on preload-style settings on day one. ...

HTTP Strict Transport Security is one of those headers that’s simple, powerful, and easy to get subtly wrong. If you’re serving a Rust app with Actix-web, HSTS usually comes down to one header: Strict-Transport-Security: max-age=31536000; includeSubDomains That header tells browsers: “For this domain, always use HTTPS for the next year.” Once a browser sees it over a valid HTTPS connection, it will refuse to use plain HTTP for that site until the policy expires. ...

If you run Envoy at the edge, HSTS is one of those headers you should set deliberately instead of “getting around to it later”. It is simple on paper: tell browsers to always use HTTPS for your site. In practice, the question is where to inject it in an Envoy-based stack, and that choice affects operability, consistency, and the blast radius of mistakes. For Envoy, there are a few common approaches: ...

HSTS looks simple until you have more than one environment. On paper, it’s one header: Strict-Transport-Security: max-age=31536000; includeSubDomains In real teams, that header touches local development, preview deployments, staging subdomains, internal tools, CDNs, load balancers, and production rollback plans. That’s where people get burned. I’ve seen teams enable HSTS in production, break staging, lock developers out of test hosts, and then discover they can’t “just turn it off” because browsers cached the policy exactly like they were supposed to. ...

If you’ve ever copied this header without thinking too hard about it, you’re not alone: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload It shows up in blog posts, server templates, security scanners, and “best practices” snippets. Then six months later someone realizes staging is broken, a subdomain can’t be reached, or the preload submission was a terrible idea. The biggest source of confusion is max-age. People treat it like a vague “security on/off” switch. It’s not. It’s a cache lifetime, and getting it wrong can lock users into behavior you didn’t mean to enforce. ...

HTTP Strict Transport Security, or HSTS, is one of those security headers that feels deceptively simple. Set one response header, ship it, done. Except that’s not really how it works in production. If you run a Django app and want HSTS configured properly, you need to understand what it actually does, how Django exposes it, and how to roll it out without accidentally breaking local development, subdomains, or a half-migrated environment. ...

If you use WebSockets in a browser app, HSTS absolutely matters. A lot of teams set Strict-Transport-Security for normal page loads and APIs, then forget that their frontend also opens ws:// or wss:// connections. That gap creates weird mixed transport behavior at best and a downgrade risk at worst. The short version: modern browsers generally apply HSTS to WebSocket connections too. If a host is known to be HSTS, a ws:// URL to that host is treated like wss:// before the network request goes out. That’s good news, but there are edge cases and deployment mistakes that still break things. ...