Use HSTS for all responses (#526)

DFE-Digital · Jul 3, 2024 · ff68ef9 · ff68ef9
1 parent ee757a6
commit ff68ef9
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/TramsDataApi/Startup.cs b/TramsDataApi/Startup.cs
@@ -111,6 +111,12 @@ public void ConfigureServices(IServiceCollection services)
 
             services.AddSingleton<IUseCase<string, ApiUser>, ApiKeyService>();
             services.AddSingleton<ApiUserEnricher>();
+            services.AddHsts(options =>
+            {
+                options.Preload = true;
+                options.IncludeSubDomains = true;
+                options.MaxAge = TimeSpan.FromDays(365);
+            });
         }
 
         // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
@@ -169,6 +175,7 @@ public void Configure(IApplicationBuilder app, IWebHostEnvironment env, IApiVers
             app.UseHttpsRedirection();
             app.UseRouting();
             app.UseAuthorization();
+            app.UseHsts();
 
             app.UseEndpoints(endpoints => { endpoints.MapControllers(); });
         }