Security-Headers

HTTP Strict Transport Security is one of those headers that’s simple, powerful, and easy to get subtly wrong. If you’re serving a Rust app with Actix-web, HSTS usually comes down to one header: Strict-Transport-Security: max-age=31536000; includeSubDomains That header tells browsers: “For this domain, always use HTTPS for the next year.” Once a browser sees it over a valid HTTPS connection, it will refuse to use plain HTTP for that site until the policy expires. ...

If you run Envoy at the edge, HSTS is one of those headers you should set deliberately instead of “getting around to it later”. It is simple on paper: tell browsers to always use HTTPS for your site. In practice, the question is where to inject it in an Envoy-based stack, and that choice affects operability, consistency, and the blast radius of mistakes. For Envoy, there are a few common approaches: ...

HSTS looks simple until you have more than one environment. On paper, it’s one header: Strict-Transport-Security: max-age=31536000; includeSubDomains In real teams, that header touches local development, preview deployments, staging subdomains, internal tools, CDNs, load balancers, and production rollback plans. That’s where people get burned. I’ve seen teams enable HSTS in production, break staging, lock developers out of test hosts, and then discover they can’t “just turn it off” because browsers cached the policy exactly like they were supposed to. ...

If you’ve ever copied this header without thinking too hard about it, you’re not alone: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload It shows up in blog posts, server templates, security scanners, and “best practices” snippets. Then six months later someone realizes staging is broken, a subdomain can’t be reached, or the preload submission was a terrible idea. The biggest source of confusion is max-age. People treat it like a vague “security on/off” switch. It’s not. It’s a cache lifetime, and getting it wrong can lock users into behavior you didn’t mean to enforce. ...

HTTP Strict Transport Security, or HSTS, is one of those security headers that feels deceptively simple. Set one response header, ship it, done. Except that’s not really how it works in production. If you run a Django app and want HSTS configured properly, you need to understand what it actually does, how Django exposes it, and how to roll it out without accidentally breaking local development, subdomains, or a half-migrated environment. ...

If you use WebSockets in a browser app, HSTS absolutely matters. A lot of teams set Strict-Transport-Security for normal page loads and APIs, then forget that their frontend also opens ws:// or wss:// connections. That gap creates weird mixed transport behavior at best and a downgrade risk at worst. The short version: modern browsers generally apply HSTS to WebSocket connections too. If a host is known to be HSTS, a ws:// URL to that host is treated like wss:// before the network request goes out. That’s good news, but there are edge cases and deployment mistakes that still break things. ...

HSTS looks simple: send one header and the browser forces HTTPS from then on. In Laravel, that usually means one middleware or one web server config change. And yet, teams still manage to break logins, lock users into bad cert setups, or preload domains before they’re actually ready. I’ve seen all three. If you run a Laravel app, HSTS is worth doing. You just need to avoid the usual footguns. ...

HSTS looks simple: send Strict-Transport-Security, force browsers onto HTTPS, move on. Then AWS gets involved. I’ve seen teams enable HTTPS on an ALB or CloudFront, add a redirect somewhere, and assume they’re done. They aren’t. HSTS in AWS usually breaks because the setup spans multiple layers: browser, CloudFront, load balancer, origin, app, and sometimes a second redirect hiding in the middle. Here are the mistakes I see most often, and how to fix them. ...

A few years ago I watched a team turn on HSTS in production with a one-line config change and a lot of confidence. By lunch, support had a queue full of users who couldn’t reach a legacy upload app on a forgotten subdomain. By the end of the day, the team had learned the hard way that HSTS is easy to enable and surprisingly hard to roll back once browsers cache it. ...

I’ve seen the same Render setup more than once: HTTPS is enabled, the app works, redirects are in place, and everyone assumes transport security is “done.” Then someone runs a header scan and realizes the site still skips one of the most useful protections you can ship in five minutes: HSTS. This is a real-world style case study based on a common Render deployment pattern. Same stack, same hosting model, same mistake. ...