# Http-https redirect does not provide sts headers

**URL:** <https://community.traefik.io/t/http-https-redirect-does-not-provide-sts-headers/11232>\
**Category:** Traefik v2\
**Tags:** file\
**Created:** [July 19, 2021, 10:17pm UTC](https://community.traefik.io/t/http-https-redirect-does-not-provide-sts-headers/11232 "2021-07-19T22:17:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![razr](https://avatars.discourse-cdn.com/v4/letter/r/f14d63/32.png) [@razr](https://community.traefik.io/u/razr)\
**Post date:** [July 19, 2021, 10:17pm UTC](https://community.traefik.io/t/http-https-redirect-does-not-provide-sts-headers/11232/1 "2021-07-19T22:17:39Z")

</div>

I have a global http-https redirect in place. I also have a couple of default headers, that are added to all my routers through a default middleware. The config looks somewhat like this:

staticconfig:

```yaml
...
entryPoints:
  web:
    address: :80
    http:
      middlewares:
        - default-headers@file
      redirections:
        entryPoint:
          to: websecure
          scheme: https
          permanent: true
  websecure:
    address: :443
    http:
      middlewares:
        - default-headers@file
      tls: true
``.

```

dynamicconfig:

```yaml
...
http:
  middlewares:
    default-headers:
      headers:
        stsSeconds: 315360000
        stsIncludeSubdomains: true
        customFrameOptionsValue: SAMEORIGIN
        contentTypeNosniff: true
        customResponseHeaders:
          Server: ""
          X-Application-Context: ""
          X-Powered-By: ""
          exception: ""
...

```

Unfortunately this does not seem to set all headers on the http endpoints. Especially the hsts header is missing which provides a security issue, as it might allow mitm attacks:

```bash
razr@nb [~]
-> % curl -L -I http://www.mydomain.com
HTTP/1.1 308 Permanent Redirect
Location: https://www.mydomain.com/
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Date: ...
Content-Length: 18
Content-Type: text/plain; charset=utf-8

HTTP/2 200
accept-ranges: bytes
content-type: text/html
date: ...
etag: "60e584c1-231"
last-modified: ...
strict-transport-security: max-age=315360000; includeSubDomains
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-length: 561

razr@nb [~]
-> %

```

Is it possible somehow to enable all the same headers on the http endpoints as well?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![daniel.tomcej](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/daniel.tomcej/32/262_2.png) [@daniel.tomcej](https://community.traefik.io/u/daniel.tomcej)\
**Post date:** [July 19, 2021, 10:35pm UTC](https://community.traefik.io/t/http-https-redirect-does-not-provide-sts-headers/11232/2 "2021-07-19T22:35:24Z")

</div>

Hello @razr,

The HSTS headers are often not added to HTTP responses, as they are often ignored by browsers in an HTTP response: ([Strict-Transport-Security - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security#description)).

If you want to force the HSTS headers to be added to your http response, you can use the `forceSTSHeader` option in the headers middlewares: ([Headers - Traefik](https://doc.traefik.io/traefik/middlewares/headers/#forcestsheader))

---

<div class="post-metadata">

**Author:** ![razr](https://avatars.discourse-cdn.com/v4/letter/r/f14d63/32.png) [@razr](https://community.traefik.io/u/razr)\
**Post date:** [July 19, 2021, 10:39pm UTC](https://community.traefik.io/t/http-https-redirect-does-not-provide-sts-headers/11232/3 "2021-07-19T22:39:47Z")

</div>

Hey @daniel.tomcej ,

thanks for the fast response!

Works like a charm! Could have found this in the docu myself. Thought I had a look there, but did not stumble upon that. Thanks a lot!