HSTS Mistakes in Starlette and How to Fix Them
HSTS looks simple: send one response header and browsers stop using HTTP for your site. In practice, Starlette apps often get HSTS half-right, which is usually the worst version of security. The app sends the header sometimes, or only on a couple routes, or it trusts the wrong proxy headers, or someone enables preload without understanding the blast radius. Here are the mistakes I see most often with Starlette, and how I’d fix them. ...