GCS-28: add Strict-T Strict-Transport-Security headers

nhsconnect · Nov 15, 2024 · 3a0d6a3 · 3a0d6a3
1 parent e192751
commit 3a0d6a3
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/...ect-appointment-checker/Core/Configuration/Infrastructure/ApplicationBuilderExtensions.cs b/...ect-appointment-checker/Core/Configuration/Infrastructure/ApplicationBuilderExtensions.cs
@@ -21,6 +21,12 @@ public static void ConfigureApplicationBuilderServices(this IApplicationBuilder
 
             if (!env.IsDevelopment())
             {
+                app.Use(async (context, next) =>
+                {
+                    context.Response.Headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains; preload";
+                    await next();
+                });
+
                 app.UseExceptionHandler("/Error");
                 app.UseHsts();
             }