Fix missing HSTS headers

HTTP Strict Transport Security or HSTS is another web application security mechanism that helps prevent man-in-the-middle attacks. It allows web servers to send a special HTTP Response header that informs supporting browsers that the subsequent communication and transmission of data should only be done over HTTPS; otherwise, succeeding connections will not be allowed.

Failing to opt-in HSTS as an additional security policy does not eliminate the threat of sensitive data interception. Supplementing HTTPS with HSTS will thwart the risk of a user being exposed to an unencrypted channel.

This recipe will teach us how to enable the missing HSTS in our sample ASP.NET Core web application to force the client to communicate over HTTPS entirely.

Getting ready

We will be using the Online Banking app we used in the previous recipe. Using Visual Studio Code, open the sample Online Banking app folder at \Chapter04\missing-hsts\before\OnlineBankingApp\.

You...