HSTS

The HSTS plugin (previously known as feature) will add the required HTTP Strict Transport Security headers to the request according to the RFC 6797.

When the browser receives HSTS policy headers, it will no longer attempt to connect to the server with insecure connections for the given period of time.

Usage

fun Application.main() {
  // ...
  install(HSTS) 
  // ...
}

The code above installs HSTS with the default configuration.

Configuration

maxAge (default is 1 year): duration to tell the client to keep the host in a list of known HSTS hosts
includeSubDomains (default is true): adds includeSubDomains directive, which applies this policy to this domain and any subdomains
preload (default is false): consents that the policy allows including the domain into web browser preloading list
customDirectives (default is empty): any custom directives supported by specific user-agent

Last modified: 27 May 2021