Quantcast
Viewing all articles
Browse latest Browse all 1515

Strict-Transport-Security max-age not updating to 31536000 in ASP.NET Core application

I am trying to set the Strict-Transport-Security header in my ASP.NET Core application to enforce HTTPS with a max-age of 1 year (31536000 seconds), along with includeSubDomains and preload. However, when I check the headers in the browser, the max-age value is always set to 2592000 (30 days) instead of 31536000.

Here is the middleware code I am using:

app.Use(async (context, next) =>{    if (!env.IsDevelopment())    {        context.Response.Headers.Append("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");    }    await next();});

I have also verified that:

The application is running in the production environment (env.IsDevelopment() is false).The browser cache has been cleared.The application is deployed on Azure with HTTPS enabled.Why is the max-age value in the Strict-Transport-Security header not updating to 31536000? Is there any configuration in Azure or ASP.NET Core that might override this value?


Viewing all articles
Browse latest Browse all 1515

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>