Strict-Transport-Security header has no value

Viewed 951

I am trying to set the Strict-Transport-Security header for a site. I have done quite a bit of research on this and my code below should work:

    public void ConfigureServices(IServiceCollection services)
    {
        // CODE NOT RELEVANT TO THE QUESTION HAS BEEN REMOVED

        services.AddHsts(options =>
        {
            options.Preload = true;
            options.IncludeSubDomains = true;
            options.MaxAge = TimeSpan.FromDays(365);
        });

        // CODE NOT RELEVANT TO THE QUESTION HAS BEEN REMOVED
    }

    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        // CODE NOT RELEVANT TO THE QUESTION HAS BEEN REMOVED

        if (!env.IsProduction())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler("/Error");
            app.UseHsts();
        }

        app.UseHttpsRedirection();
        app.UseStaticFiles();
        app.UseSpaStaticFiles();
        app.UseCookiePolicy();
        app.UseAuthentication();
        app.UseAntiforgeryToken();

        // CODE NOT RELEVANT TO THE QUESTION HAS BEEN REMOVED
    }

My current code is based on this: https://docs.microsoft.com/en-us/aspnet/core/security/enforcing-ssl?view=aspnetcore-3.1&tabs=visual-studio#http-strict-transport-security-protocol-hsts

For some reason, I am seeing the header. The issue is that the value is empty. I want to have a maxage set in the value but it is not showing. I would appreciate any help.

Relevant details:

  • This is .NET Core 2.1
  • I know you can hardcode the header on IIS or install a 3rd party nuget package. I unfortunately cannot use that. I am trying to get the default .NET capability.
  • I am testing for the header value in production environment, just in case you think that if statement is the issue.

EDIT: Adding header image

Headers shown on Chrome dev tool

0 Answers
Related