ASP.NET Core Interview Question #89

What is HSTS and UseHsts()?

Middleware & Request Pipeline Mid-Level Intermediate

Quick Interview Answer

HTTP Strict Transport Security (HSTS) tells compatible browsers that a site should be accessed only over HTTPS for a specified period.

Detailed Explanation

HTTP Strict Transport Security (HSTS) tells compatible browsers that a site should be accessed only over HTTPS for a specified period.

UseHsts() adds the Strict-Transport-Security response header according to configured HSTS options. It is commonly enabled in production but not during local development because browsers can cache the policy and make local troubleshooting difficult.

HSTS is useful only after HTTPS is correctly configured and should be deployed carefully for real domains.

Code Example

if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Home/Error");
    app.UseHsts();
}

app.UseHttpsRedirection();