I am trying to set the Strict-Transport-Security header for a site. I have done quite a bit of research on this and my code below should work:
public void ConfigureServices(IServiceCollection services)
{
// CODE NOT RELEVANT TO THE QUESTION HAS BEEN REMOVED
services.AddHsts(options =>
{
options.Preload = true;
options.IncludeSubDomains = true;
options.MaxAge = TimeSpan.FromDays(365);
});
// CODE NOT RELEVANT TO THE QUESTION HAS BEEN REMOVED
}
public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
// CODE NOT RELEVANT TO THE QUESTION HAS BEEN REMOVED
if (!env.IsProduction())
{
app.UseDeveloperExceptionPage();
}
else
{
app.UseExceptionHandler("/Error");
app.UseHsts();
}
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseSpaStaticFiles();
app.UseCookiePolicy();
app.UseAuthentication();
app.UseAntiforgeryToken();
// CODE NOT RELEVANT TO THE QUESTION HAS BEEN REMOVED
}
My current code is based on this: https://docs.microsoft.com/en-us/aspnet/core/security/enforcing-ssl?view=aspnetcore-3.1&tabs=visual-studio#http-strict-transport-security-protocol-hsts
For some reason, I am seeing the header. The issue is that the value is empty. I want to have a maxage set in the value but it is not showing. I would appreciate any help.
Relevant details:
- This is .NET Core 2.1
- I know you can hardcode the header on IIS or install a 3rd party nuget package. I unfortunately cannot use that. I am trying to get the default .NET capability.
- I am testing for the header value in production environment, just in case you think that if statement is the issue.
EDIT: Adding header image
