Security: HSTS
This course examines the Strict-Transport-Security header that Rails sends when config.force_ssl is true. Its defaults send a two-year max-age with includeSubDomains and no preload. The lessons explain how browsers store and refresh HSTS rules, which gap a plain HTTP redirect leaves, and what includeSubDomains requires of every subdomain. They cover ramping max-age, disabling with max-age=0, the preload list and its requirements, and interactions with health checks, certificate renewal, cookies and local development. The course ends with a written HSTS plan.
What you'll learn
- ✓What Rails' default HSTS options send and what they commit a domain to
- ✓How browsers record, refresh and apply HSTS rules per host
- ✓How to build a subdomain inventory from DNS, certificate transparency logs, ingress and the team
- ✓How to ramp max-age safely and how to disable HSTS with max-age=0
- ✓The preload list requirements and the cost of removal
- ✓How HSTS interacts with health checks, ACME validation, cookies and development
What this app is already promising
One line in config/environments/production.rb:
Read the full lesson free →Curriculum
7 lessonsWhat this app is already promising
Shows that Rails' force_ssl sends a two-year HSTS header covering all subdomains, and why to set it explicitly.
How HSTS actually works
Explains the plain HTTP gap a redirect leaves, how browsers store HSTS rules, and the first-visit limit.
includeSubDomains and the inventory
Covers what includeSubDomains applies to, why domain-scoped cookies need it, and how to inventory every subdomain.
Ramping max-age, and disabling
Describes ramping max-age from five minutes to two years and disabling HSTS by sending max-age=0 over HTTPS.
The preload list
Explains the preload list, its four requirements, the months-long removal, and when submitting is worth the cost.
HSTS in context
Covers HSTS interactions with health checks, ACME renewal, other security headers, secure cookies and local development.
Putting it together: an HSTS plan
Builds an HSTS plan: explicit options, a subdomain inventory, a recorded preload decision, and a ramp for new domains.