What's the point of adding UseHsts() in Start.cs

-3

According to the docs, adding UseHsts() in the config activates the middleware for STS related header.

I've never quite understand the point of it. Does it mean nothing more than simply adding a header to each request that the application does? What can go wrong if I don't use that header?

Also, I noticed that when I try to look it up for Core 2.2 (the link above), I get redirected to Core 2.1 with the remark that UseHsts() isn't present in the former version. Does it mean it's been obsolete or is using a default that hides the magic?

edited Jan 1 at 18:10

Stephen Kennedy

7,418135069

asked Jan 1 at 15:57

Konrad Viltersten

12.6k32137257

2

The HSTS header prevents a browser from requesting anything from that site again in a non-secured way, what makes you think that is not useful? Also, the doc link doesn't say the info is obsolete, just that they haven't reviewed it for 2.2 - it's still very much relevant.

– DavidG
Jan 1 at 16:06

1

Thanks @DavidG .. You made me go over the stackoverflow policy on plagiarism ...

– Soumen Mukherjee
Jan 1 at 18:07

@SoumenMukherjee Are you implying that my post is a plagiarism? Not following...

– Konrad Viltersten
Jan 1 at 19:40

@DavidG Aha, I thought that was achieved by UseHttpsRedirection(). Thanks for correcting me and, also, thanks for the explanation about the link/obsolete confusion. You might want to post it as a reply so I can accept it as the right answer.

– Konrad Viltersten
Jan 1 at 19:46

@SoumenMukherjee I did not delete your answer, a moderator did. Also, really peculiar to use my full name as it's not mentioned here on Stack Overflow...

– DavidG
Jan 4 at 17:19

|
show 1 more comment

-3

According to the docs, adding UseHsts() in the config activates the middleware for STS related header.

I've never quite understand the point of it. Does it mean nothing more than simply adding a header to each request that the application does? What can go wrong if I don't use that header?

edited Jan 1 at 18:10

Stephen Kennedy

7,418135069

asked Jan 1 at 15:57

Konrad Viltersten

12.6k32137257

2

The HSTS header prevents a browser from requesting anything from that site again in a non-secured way, what makes you think that is not useful? Also, the doc link doesn't say the info is obsolete, just that they haven't reviewed it for 2.2 - it's still very much relevant.

– DavidG
Jan 1 at 16:06

1

Thanks @DavidG .. You made me go over the stackoverflow policy on plagiarism ...

– Soumen Mukherjee
Jan 1 at 18:07

@SoumenMukherjee Are you implying that my post is a plagiarism? Not following...

– Konrad Viltersten
Jan 1 at 19:40

@DavidG Aha, I thought that was achieved by UseHttpsRedirection(). Thanks for correcting me and, also, thanks for the explanation about the link/obsolete confusion. You might want to post it as a reply so I can accept it as the right answer.

– Konrad Viltersten
Jan 1 at 19:46

@SoumenMukherjee I did not delete your answer, a moderator did. Also, really peculiar to use my full name as it's not mentioned here on Stack Overflow...

– DavidG
Jan 4 at 17:19

|
show 1 more comment

-3

According to the docs, adding UseHsts() in the config activates the middleware for STS related header.

I've never quite understand the point of it. Does it mean nothing more than simply adding a header to each request that the application does? What can go wrong if I don't use that header?

edited Jan 1 at 18:10

Stephen Kennedy

7,418135069

asked Jan 1 at 15:57

Konrad Viltersten

12.6k32137257

According to the docs, adding UseHsts() in the config activates the middleware for STS related header.

I've never quite understand the point of it. Does it mean nothing more than simply adding a header to each request that the application does? What can go wrong if I don't use that header?

c# asp.net-core .net-core asp.net-core-2.2

edited Jan 1 at 18:10

Stephen Kennedy

7,418135069

asked Jan 1 at 15:57

Konrad Viltersten

12.6k32137257

edited Jan 1 at 18:10

Stephen Kennedy

7,418135069

asked Jan 1 at 15:57

Konrad Viltersten

12.6k32137257

edited Jan 1 at 18:10

Stephen Kennedy

7,418135069

edited Jan 1 at 18:10

Stephen Kennedy

7,418135069

edited Jan 1 at 18:10

Stephen Kennedy

7,418135069

asked Jan 1 at 15:57

Konrad Viltersten

12.6k32137257

asked Jan 1 at 15:57

Konrad Viltersten

12.6k32137257

asked Jan 1 at 15:57

Konrad Viltersten

12.6k32137257

2

The HSTS header prevents a browser from requesting anything from that site again in a non-secured way, what makes you think that is not useful? Also, the doc link doesn't say the info is obsolete, just that they haven't reviewed it for 2.2 - it's still very much relevant.

– DavidG
Jan 1 at 16:06

1

Thanks @DavidG .. You made me go over the stackoverflow policy on plagiarism ...

– Soumen Mukherjee
Jan 1 at 18:07

@SoumenMukherjee Are you implying that my post is a plagiarism? Not following...

– Konrad Viltersten
Jan 1 at 19:40

@DavidG Aha, I thought that was achieved by UseHttpsRedirection(). Thanks for correcting me and, also, thanks for the explanation about the link/obsolete confusion. You might want to post it as a reply so I can accept it as the right answer.

– Konrad Viltersten
Jan 1 at 19:46

@SoumenMukherjee I did not delete your answer, a moderator did. Also, really peculiar to use my full name as it's not mentioned here on Stack Overflow...

– DavidG
Jan 4 at 17:19

|
show 1 more comment

2

The HSTS header prevents a browser from requesting anything from that site again in a non-secured way, what makes you think that is not useful? Also, the doc link doesn't say the info is obsolete, just that they haven't reviewed it for 2.2 - it's still very much relevant.

– DavidG
Jan 1 at 16:06

1

Thanks @DavidG .. You made me go over the stackoverflow policy on plagiarism ...

– Soumen Mukherjee
Jan 1 at 18:07

@SoumenMukherjee Are you implying that my post is a plagiarism? Not following...

– Konrad Viltersten
Jan 1 at 19:40

@DavidG Aha, I thought that was achieved by UseHttpsRedirection(). Thanks for correcting me and, also, thanks for the explanation about the link/obsolete confusion. You might want to post it as a reply so I can accept it as the right answer.

– Konrad Viltersten
Jan 1 at 19:46

@SoumenMukherjee I did not delete your answer, a moderator did. Also, really peculiar to use my full name as it's not mentioned here on Stack Overflow...

– DavidG
Jan 4 at 17:19

The HSTS header prevents a browser from requesting anything from that site again in a non-secured way, what makes you think that is not useful? Also, the doc link doesn't say the info is obsolete, just that they haven't reviewed it for 2.2 - it's still very much relevant.

– DavidG
Jan 1 at 16:06

Thanks @DavidG .. You made me go over the stackoverflow policy on plagiarism ...

– Soumen Mukherjee
Jan 1 at 18:07

@SoumenMukherjee Are you implying that my post is a plagiarism? Not following...

– Konrad Viltersten
Jan 1 at 19:40

@DavidG Aha, I thought that was achieved by UseHttpsRedirection(). Thanks for correcting me and, also, thanks for the explanation about the link/obsolete confusion. You might want to post it as a reply so I can accept it as the right answer.

– Konrad Viltersten
Jan 1 at 19:46

@SoumenMukherjee I did not delete your answer, a moderator did. Also, really peculiar to use my full name as it's not mentioned here on Stack Overflow...

– DavidG
Jan 4 at 17:19

|
show 1 more comment

2 Answers
2

active

oldest

votes

HTTP Strict Transport Security (HSTS) allows a site to request that it always be contacted over HTTPS. HSTS is supported in Google Chrome, Firefox, Safari, Opera, Edge and IE

Reference https://www.chromium.org/hsts

HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against protocol downgrade attacks and cookie hijacking. It allows web servers to declare that web browsers (or other complying user agents) should interact with it using only secure HTTPS connections,1 and never via the insecure HTTP protocol. HSTS is an IETF standards track protocol and is specified in RFC 6797

answered Jan 1 at 18:13

Simonare

15.1k11840

add a comment |

If you are using TLS you should enable this flag. Note: Be sure you don't enable it on localhost (if you aren't using TLS on localhost). You'll be unable to load the website. You'll need to invalidate the cache on your browser.

answered Jan 1 at 19:45

distrupt

111

Thanks for the reply. Your answer doesn't actually addresses the issue being asked, though. The question isn't what it does (that's provided in the question by the linkage to the docs). I'm asking why I'd need it and what can go wrong if I don't. The reason for that is me thinking that UserHttpRedirection() was doing that job already. However, the point on not using it on localhost (which is usually done automagically by the template setting a conditional statement relying of development environment) is informative.

– Konrad Viltersten
Jan 1 at 19:50

add a comment |

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53996863%2fwhats-the-point-of-adding-usehsts-in-start-cs%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

2 Answers
2

active

oldest

votes

2 Answers
2

active

oldest

votes

HTTP Strict Transport Security (HSTS) allows a site to request that it always be contacted over HTTPS. HSTS is supported in Google Chrome, Firefox, Safari, Opera, Edge and IE

Reference https://www.chromium.org/hsts

HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against protocol downgrade attacks and cookie hijacking. It allows web servers to declare that web browsers (or other complying user agents) should interact with it using only secure HTTPS connections,1 and never via the insecure HTTP protocol. HSTS is an IETF standards track protocol and is specified in RFC 6797

answered Jan 1 at 18:13

Simonare

15.1k11840

add a comment |

HTTP Strict Transport Security (HSTS) allows a site to request that it always be contacted over HTTPS. HSTS is supported in Google Chrome, Firefox, Safari, Opera, Edge and IE

Reference https://www.chromium.org/hsts

HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against protocol downgrade attacks and cookie hijacking. It allows web servers to declare that web browsers (or other complying user agents) should interact with it using only secure HTTPS connections,1 and never via the insecure HTTP protocol. HSTS is an IETF standards track protocol and is specified in RFC 6797

answered Jan 1 at 18:13

Simonare

15.1k11840

add a comment |

HTTP Strict Transport Security (HSTS) allows a site to request that it always be contacted over HTTPS. HSTS is supported in Google Chrome, Firefox, Safari, Opera, Edge and IE

Reference https://www.chromium.org/hsts

HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against protocol downgrade attacks and cookie hijacking. It allows web servers to declare that web browsers (or other complying user agents) should interact with it using only secure HTTPS connections,1 and never via the insecure HTTP protocol. HSTS is an IETF standards track protocol and is specified in RFC 6797

answered Jan 1 at 18:13

Simonare

15.1k11840

HTTP Strict Transport Security (HSTS) allows a site to request that it always be contacted over HTTPS. HSTS is supported in Google Chrome, Firefox, Safari, Opera, Edge and IE

Reference https://www.chromium.org/hsts

HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against protocol downgrade attacks and cookie hijacking. It allows web servers to declare that web browsers (or other complying user agents) should interact with it using only secure HTTPS connections,1 and never via the insecure HTTP protocol. HSTS is an IETF standards track protocol and is specified in RFC 6797

answered Jan 1 at 18:13

Simonare

15.1k11840

answered Jan 1 at 18:13

Simonare

15.1k11840

answered Jan 1 at 18:13

Simonare

15.1k11840

answered Jan 1 at 18:13

Simonare

15.1k11840

add a comment |

answered Jan 1 at 19:45

distrupt

111

Thanks for the reply. Your answer doesn't actually addresses the issue being asked, though. The question isn't what it does (that's provided in the question by the linkage to the docs). I'm asking why I'd need it and what can go wrong if I don't. The reason for that is me thinking that UserHttpRedirection() was doing that job already. However, the point on not using it on localhost (which is usually done automagically by the template setting a conditional statement relying of development environment) is informative.

– Konrad Viltersten
Jan 1 at 19:50

add a comment |

answered Jan 1 at 19:45

distrupt

111

Thanks for the reply. Your answer doesn't actually addresses the issue being asked, though. The question isn't what it does (that's provided in the question by the linkage to the docs). I'm asking why I'd need it and what can go wrong if I don't. The reason for that is me thinking that UserHttpRedirection() was doing that job already. However, the point on not using it on localhost (which is usually done automagically by the template setting a conditional statement relying of development environment) is informative.

– Konrad Viltersten
Jan 1 at 19:50

add a comment |

answered Jan 1 at 19:45

distrupt

111

answered Jan 1 at 19:45

distrupt

111

answered Jan 1 at 19:45

distrupt

111

answered Jan 1 at 19:45

distrupt

111

answered Jan 1 at 19:45

distrupt

111

Thanks for the reply. Your answer doesn't actually addresses the issue being asked, though. The question isn't what it does (that's provided in the question by the linkage to the docs). I'm asking why I'd need it and what can go wrong if I don't. The reason for that is me thinking that UserHttpRedirection() was doing that job already. However, the point on not using it on localhost (which is usually done automagically by the template setting a conditional statement relying of development environment) is informative.

– Konrad Viltersten
Jan 1 at 19:50

add a comment |

Thanks for the reply. Your answer doesn't actually addresses the issue being asked, though. The question isn't what it does (that's provided in the question by the linkage to the docs). I'm asking why I'd need it and what can go wrong if I don't. The reason for that is me thinking that UserHttpRedirection() was doing that job already. However, the point on not using it on localhost (which is usually done automagically by the template setting a conditional statement relying of development environment) is informative.

– Konrad Viltersten
Jan 1 at 19:50

Thanks for the reply. Your answer doesn't actually addresses the issue being asked, though. The question isn't what it does (that's provided in the question by the linkage to the docs). I'm asking why I'd need it and what can go wrong if I don't. The reason for that is me thinking that UserHttpRedirection() was doing that job already. However, the point on not using it on localhost (which is usually done automagically by the template setting a conditional statement relying of development environment) is informative.

– Konrad Viltersten
Jan 1 at 19:50

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

Search This Blog

Ufyukyu