Enable HTTP Strict Transport Security

    编辑本页

    预计阅读时间： 2 分钟

    This feature will add the required HTTP Strict Transport Security headers to the request according to the RFC 6797.

    HSTS policy headers are ignored over an insecure HTTP connection. For HSTS to take effect, it should be served over a secure (https) connection.

    When the browser receives HSTS policy headers, it will no longer attempt to connect to the server with insecure connections for the given period of time.

    本特性在 io.ktor.features.HSTS 类中定义，无需任何额外构件。

    Usage

    fun Application.main() {
  // ...
  install(HSTS) 
  // ...
}

    The code above installs HSTS with the default configuration.

    Configuration

    • maxAge (default is 1 year): duration to tell the client to keep the host in a list of known HSTS hosts
    • includeSubDomains (default is true): adds includeSubDomains directive, which applies this policy to this domain and any subdomains
    • preload (default is false): consents that the policy allows including the domain into web browser preloading list
    • customDirectives (default is empty): any custom directives supported by specific user-agent