Implement HSTS after confirming HTTPS works end to end, then send the Strict-Transport-Security header from the application. In ASP.NET Core, use HTTPS redirection and HSTS middleware, set a cautious max-age first, and only enable includeSubDomains or preload after every subdomain is verified. This approach reduces SSL stripping by telling browsers to use HTTPS only.
How HSTS fits into ASP.NET Core request handling
HSTS is a browser-side trust signal, so the application’s job is to emit it consistently once HTTPS is already working. In ASP.NET Core, that means the middleware must run on the secure path, after redirect logic is in place, and only for responses that should instruct browsers to remember HTTPS for the site. The header does not fix broken TLS, but it closes the downgrade window that SSL stripping attacks depend on.
For teams shipping ASP.NET Core apps, the practical decision is whether the site is truly ready to be remembered as HTTPS-only. That is less about code volume and more about deployment reality: certificate validity, reverse proxy behavior, canonical hostnames, and whether every user-facing endpoint can survive an HTTPS-only posture without mixed content or orphaned HTTP endpoints.
- Confirm HTTPS redirection works before enabling HSTS, because a browser cannot safely remember HTTPS for a site that still fails on secure requests.
- Emit the header only from the HTTPS response path, so the browser receives a trustworthy policy statement.
- Start with a short max-age, then increase it once operational checks show the deployment is stable.
Safe configuration choices in ASP.NET Core
The safest implementation pattern is to treat HSTS as the final hardening step, not the first. ASP.NET Core typically pairs HTTPS redirection with HSTS middleware, but the order matters: redirect insecure requests to HTTPS, then send Strict-Transport-Security on the secure response. This sequence ensures users arrive over TLS before the browser stores the policy.
Teams should be conservative with includeSubDomains and preload. Those options are only appropriate when every subdomain is under the same HTTPS discipline and you are prepared for the operational commitment they create. A mistake here can break legacy subdomains, administrative portals, or delegated services that still depend on plain HTTP or have incomplete certificate coverage.
A cautious rollout is usually better than an aggressive one. If a team is not certain about every subdomain, use a limited policy first, verify external dependencies, and only then extend scope. That approach reduces the chance of self-inflicted outages while still eliminating the most common SSL stripping path.
For implementation guidance, the ASP.NET Core team should also review established hardening and lifecycle guidance in OWASP Cheat Sheet Series and align transport policy with baseline control expectations in ISO/IEC 27002:2022 Information Security Controls. For a broader control lens, NIST Cybersecurity Framework 2.0 helps teams tie transport protection to their wider protection and governance practices.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS 3 — Data Protection | HTTPS transport hardening protects data in transit from downgrade and interception. |
| CIS 4 — Secure Configuration of Enterprise Assets and Software | HSTS middleware is a secure configuration choice for web applications and platforms. | |
| CIS 16 — Application Software Security | ASP.NET Core HSTS is an application-layer security control that must be implemented and verified correctly. | |
| Recommendation — Enforce secure transport for web traffic and protect data in transit with approved cryptographic channels. Harden application and platform settings so HTTPS redirection and HSTS are consistently enabled. Build transport security into the application and verify security headers as part of release validation. | ||
| NIST CSF 2.0 | PR.DS — Data Security | HSTS helps protect data in transit by preventing protocol downgrade to HTTP. |
| PR.DS-2 — Data-in-Transit Encryption | HSTS supports enforcing encrypted web sessions and reducing SSL stripping exposure. | |
| PR.PT — Protective Technology | HSTS and HTTPS redirection are protective technologies that strengthen browser-facing access paths. | |
| Recommendation — Apply transport protections that keep sensitive data encrypted in transit. Require encrypted channels for browser traffic and verify that HTTP is redirected to HTTPS. Deploy browser-facing protective controls that enforce secure transport and reduce downgrade risk. | ||
Practitioner Guidance
What to verify: Verify the site behaves correctly behind the actual production edge, not just on localhost. Proxy termination, forwarded headers, certificate renewal, and hostname canonicalisation all need to be tested together, because HSTS is only useful if the HTTPS experience is reliable.
Decision rule: If any public subdomain or alternate hostname still cannot guarantee HTTPS, delay includeSubDomains and preload. If the site is fully HTTPS-clean and stable, extend the policy gradually and document the operational owner for future certificate and DNS changes.
Common mistake: Teams often enable HSTS too early and then discover a forgotten endpoint, redirect loop, or expired certificate. That turns a browser protection into an availability problem, so rollout discipline matters as much as the middleware setting itself.
Practitioner takeaway: HSTS reduces SSL stripping only when the HTTPS posture is already dependable, so treat it as a confirmation of transport maturity rather than a substitute for it.
Related resources from NHI Mgmt Group
- How should teams implement claims-based authentication in ASP.NET Core without weakening access control?
- How should development teams prevent broken authentication in ASP.NET Core applications?
- How should security teams reduce supply chain risk in GitHub-based development pipelines?
- How should security teams implement SSO in a .NET application without creating callback risk?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
