40

On the Startup.cs file of an .NET Core app, by default it make use of

    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseHsts();
        }

But in some cases I can find the use of

    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler();
        }

What is the difference?

4 Answers 4

56

Hsts is a security feature to force SSL. It has nothing to do with exceptions.

3
  • 7
    How does it enforce SSL? I see no change at all. My app still launches in http. Commented Sep 27, 2018 at 17:08
  • 4
    It is not guaranteed to limit traffic to HTTPS only, so I think forcing SSL should not be mentioned, it depends on client support. also it needs at least 1 successful HTTPS. Commented Jan 20, 2020 at 12:36
  • 1
    @DanielJackson: when returned as a header from a website, it indicates to the client that the server wants you to use HTTPS for all future requests. This does not force the client to use HTTPS, but in modern browsers (once they get this information) this should help prevent malicious MITM attacks which try to serve a HTTP version of this same site.
    – vgru
    Commented Jan 31, 2021 at 16:54
45

It is an old question but if you still didn't figure out the answer then this might help.

UseHsts adds a header Strict-Transport-Security to the response. When the site was accessed using HTTPS then the browser notes it down and future request using HTTP will be redirected to HTTPS. So, accessing the site using HTTPS at least once is mandatory to make this work.

Also the expiration time set by the Strict-Transport-Security header elapses, the next attempt to load the site via HTTP won't be automatically redirected to HTTPS.

4
  • 2
    What will happen if I didn't use UseHsts? Commented Jun 6, 2019 at 5:01
  • 2
    With UseHsts when a browsers makes http call the server responds with instructions to redirect the page to secure https URL. This way browsers can cahce this settings for given amount of time and browser will automatically converts http request to https. Check a similar question asked here Commented Jun 12, 2019 at 14:10
  • At least this answer gives some insights, better than the accepted one.
    – harpal
    Commented Feb 16, 2023 at 16:59
  • To be clear UseHsts does not redirect HTTP requests to HTTPS, in other words it is not a 3xx redirect response. It is a response header, which simply tells the browser to remember that it supports HTTPS for some specified period of time so that it does not try to use HTTP in the future. However, browsers (are supposed to) only honor that request after the first successful HTTPS connection to the site. Commented Aug 15 at 20:13
11

Here is additional info about UseHsts,

HSTS is a client side performance optimization to avoid an extra request to the server for more info read Ramesh's answer. but is has some limitations:

  • It is not guaranteed to limit traffic to HTTPS only.
  • It requires at least 1 successful HTTPS request.
  • It depends on client support, client may or may not support HSTS.

About UseExceptionHandler, you can use this middleware to catch unhandled exceptions globally.

1
  • 1
    You don't get any performance optimization or avoid an extra request by just using HSTS. You get that only if you also submit your site to one or more of the preload lists that are automatically included in the user's browser. Then even the first request with http will be automatically re-directed internally by the browser itself without going to the server. Commented Nov 6, 2020 at 14:33
6

You should be aware that you won't notice this header when you run against localhost, because the HSTS middleware ignores requests to 127.0.0.1 and local host.

Also this header is also only sent over HTTPS

See the source code here:

3
  • The question is old, but I have been asking myself, why in the standard MVC Core template Hsts is only applied in production mode. If it is ignored on localhost, why this extra if: if (app.Environment.IsDevelopment()) { app.UseMigrationsEndPoint(); }
    – Tillito
    Commented Mar 15, 2023 at 11:34
  • 2
    Perhaps you want to be able to mix HTTP/HTTPS during development, and that the browser does not remember that it should use HTTPS only. But as I said, it is ignored over 127.0.0.1 and localhost. Commented Mar 15, 2023 at 12:20
  • 1
    @Tillito you may run the application on IIS with a masked domain (just add the domain in the host file). In that case the BROWSER will not understand if it is localhost. It will be masked on a different layer.
    – Neophyte
    Commented Apr 18, 2023 at 8:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.