Why is use of UseHsts() in .NET Core applications?

UseHsts() tells the browser to always use a secure (HTTPS) connection when visiting your website.

Real-life analogy

Imagine your bank has a rule:

"For your safety, always enter through the main security gate. Never use the back door."

The first time you visit, the bank informs you of this rule.

After that, you remember it and always use the secure entrance.

UseHsts() works the same way.

• The secure entrance = HTTPS
• The unsafe entrance = HTTP
• The browser remembers the rule = HSTS (HTTP Strict Transport Security)

Without UseHsts()

A user types:

http://example.com

The browser first tries an unsecured HTTP connection.

Then the server redirects the user to:

https://example.com

Although the redirect works, that initial HTTP request could potentially be intercepted.

With UseHsts()

On the first secure visit, the server tells the browser:

"From now on, always use HTTPS for this website."

The browser remembers this.

Next time, if the user types:

http://example.com

the browser automatically changes it to:

https://example.com

before sending the request.

This avoids making an insecure HTTP request.

Simple Example

// Enable HSTS for the application
app.UseHsts();

What happens?

• A user visits your website using HTTPS.
• The server sends an HSTS header to the browser.
• The browser saves this rule.
• On future visits, the browser always uses HTTPS automatically.

Why is UseHsts() Important?

• Keeps user data secure.
• Prevents users from accidentally using HTTP.
• Protects against certain network attacks that rely on insecure connections.
• Makes your website more secure by enforcing HTTPS.

In One Sentence

UseHsts() tells the browser, "Always connect to this website using HTTPS, never HTTP," making future visits more secure.

Key Points

• UseHsts() enables HTTP Strict Transport Security (HSTS).
• It instructs browsers to use HTTPS only for future requests.
• It helps protect against attacks that exploit insecure HTTP connections.
• It works after the browser has visited the site securely at least once.
• It is typically enabled only in Production, not during Development.