HSTS for Java with Spring Boot: Pros, Cons, and Patterns
HTTP Strict Transport Security sounds simple: send one response header and browsers stop using HTTP for your site. In practice, Java teams still get it wrong. I’ve seen Spring Boot apps enable HSTS in one environment, forget it behind a reverse proxy, then wonder why production behavior doesn’t match local testing. If you run a Spring Boot app over HTTPS, HSTS is usually the right move. The real question is how to enable it, how aggressive to be, and when not to turn on the stricter options. ...