What is the difference between UseHttpsRedirection and UseHsts
Someone asked on Stack Overflow:
I don’t quite get the difference between
UseHstsandUseHttpsRedirectionin the configure section of the startup file in .net core. Could anyone explain?
I posted the following answer, which was chosen as the accepted answer and received 49 upvotes:
According to the documentation you should use both together:
We recommend all production ASP.NET Core web apps call:
- The HTTPS Redirection Middleware (UseHttpsRedirection) to redirect all HTTP requests to HTTPS.
- UseHsts, HTTP Strict Transport Security Protocol (HSTS).
The .UseHttpsRedirection() will issue HTTP response codes redirecting from http to https. The .UseHsts() will add the HSTS response header which the client is supposed to obey.
Notable comments
Nate (2 upvotes): They do not block incoming requests. UseHttpsRedirection should issue a redirect from http to https. UseHsts is a header to remind the browser that when they come back to this site, skip the initial http request, and go directly to https. If you want to block http completely, you’d need to do that on your host (iis, apache, etc).
Originally posted on Stack Overflow — 49 upvotes (accepted answer). Licensed under CC BY-SA.
