UseHsts not working with NetCore 2.1 Website

user_4194514 0
Viewed 6073

I followed the directions at Microsoft Documentation for configuring UseHsts, but when I hit my website, I do not see the Strict-Transport-Security header. I tried several variations on the configuration, but nothing seems to have any affect. Any ideas what I am missing?

public void ConfigureServices(IServiceCollection services)
{
    services.AddMvc();

    services.AddHsts(options =>
    {
    });

    services.AddHttpsRedirection(options =>
    {
    });            
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    app.UseHsts();
    app.UseHttpsRedirection();
    app.UseMvc();
}

This is an image of the headers that I get in Chrome, but it looks the same in every other browser, as well.

enter image description here

asp.net-core c#
4 Answers

UseHsts excludes the following loopback hosts:

  • localhost : The IPv4 loopback address.
  • 127.0.0.1 : The IPv4 loopback address.
  • [::1] : The IPv6 loopback address.

You could try to publish the web app and check the header Strict-Transport-Security.

Below is the result from publishing the site to Azure.

enter image description here

user_62656200

This MAY be related, but I had the same issue then I was using middlewared in a wrong order. This configuration enabled the response header:

app.UseForwardedHeaders();
app.UseHsts();

Of course, services.AddHsts(...) is also easy to miss.

user_1067150

Having the same issue, I came across snippet from the HstsMiddleWare test code and found it useful

As mentioned in the previous answers, the UseHsts method excludes the loopback hosts but you can clear this list by making a call to the Clear method of the ExcludedHosts property

        services.AddHsts(options =>
        {
            options.ExcludedHosts.Clear();
            options.Preload = true;
            options.IncludeSubDomains = true;
            options.MaxAge = TimeSpan.FromDays(60);
        });

NOTE: This is for the purposes of testing Hsts locally, but as mentioned in the official Microsoft documentation, it is not advisable to enable this in development "because the HSTS settings are highly cacheable by browsers"

user_43276680

I ran into the same problem in my ASP.NET Core 2.2 application. The Microsoft Documentation states there shouldn't be a need to set Max-Age explicitly in the AddHsts() method:

Explicitly sets the max-age parameter of the Strict-Transport-Security header to 60 days. If not set, defaults to 30 days. See the max-age directive for more information.

However, by setting this myself I've managed to get the header added to the response.

In ConfigureServices() in Startup.cs:

if (!this.Environment.IsDevelopment())
{
    var currentDate = DateTime.Now;

    services.AddHsts(opt =>
    {
        opt.MaxAge = currentDate.AddYears(1) - currentDate;
        opt.IncludeSubDomains = true;
    });
}

In Configure() in Startup.cs:

if (env.IsDevelopment())
{
    app.UseDeveloperExceptionPage();
}
else
{
    app.ConfigureExceptionHandler(loggerFactory);
    app.UseHsts();
}

Example response headers from my hosted application: enter image description here

NOTE: the other response headers I've added explicitly in my web.config.

user_15376730
Related