Submit HSTS to the Browser Preload List

Set Strict-Transport-Security with preload and submit the domain so future browsers refuse HTTP connections without a first-visit redirect.

~15 minsecurityhststls

Task

Implement Strict-Transport-Security: max-age=63072000; includeSubDomains; preload to close a known attack surface before the next security review finds it.

When to use this

A penetration test report flags the missing Strict-Transport-Security: max-age=63072000; includeSubDomains; preload as a medium-severity finding on a public endpoint.

Prerequisites

A running application with the vulnerable endpoint
Access to security headers or middleware config

Steps

1. Configure Strict-Transport-Security: max-age=63072000; includeSubDomains; preload in the project configuration file with the recommended defaults.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Expected output: The configuration is accepted and Strict-Transport-Security: max-age=63072000; includeSubDomains; preload runs without errors on the first invocation.

2. Run the check locally to verify Strict-Transport-Security: max-age=63072000; includeSubDomains; preload produces the expected result before pushing.

pnpm test

Expected output: Local run matches CI behavior; no surprises after push.

3. Add the gate to the CI pipeline so Strict-Transport-Security: max-age=63072000; includeSubDomains; preload blocks merge on failure.

- name: Run add hsts preload list
  run: pnpm test

Expected output: Pull requests with failing Strict-Transport-Security: max-age=63072000; includeSubDomains; preload are blocked from merging.

Troubleshooting

Problem

The check passes locally but fails in CI

Solution

Pin dependency versions and the runtime to match CI exactly; reproduce with the same Docker image or act.

Problem

Configuration is rejected with a schema error

Solution

Check the tool version matches the config schema; older versions may not support newer fields.

Limitations

The gate only runs on events that trigger the workflow; locally pushed commits bypass it.
Configuration drift is possible if someone edits settings outside version control.

Close the attack surface

Start by measuring the problem. Set Strict-Transport-Security with preload and submit the domain so future browsers refuse HTTP connections without a first-visit redirect. The most common mistake is adding the gate without first confirming it catches the issue you care about. Run Strict-Transport-Security: max-age=63072000; includeSubDomains; preload against the current codebase and inspect the output before wiring it into CI.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Verify and monitor

Once the gate is in place, make failures actionable. A failing Strict-Transport-Security: max-age=63072000; includeSubDomains; preload should point to the exact file and line, not a generic error. Pin the tool version in the lockfile so a upstream release does not silently change behavior. Review the gate output in every pull request just like a test result.