← Back to Articles         
How do HTTPS and HSTS protect the application?

How do HTTPS and HSTS protect the application?

Published on 02 Oct 2026     9 min read Angular
Security

How Do HTTPS and HSTS Protect an Angular + ASP.NET Core Application?

1. What is HTTPS?

HTTPS (Hypertext Transfer Protocol Secure) is HTTP communication protected using TLS (Transport Layer Security).

Instead of:

http://www.example.com

the application uses:

https://www.example.com

HTTPS protects communication between the browser and server.

Angular / Browser
       |
       | HTTPS / TLS
       | Encrypted
       v
ASP.NET Core API

It provides three major security properties:

  • Confidentiality — data is encrypted in transit.
  • Integrity — helps prevent data from being modified during transit.
  • Server authentication — certificates help the browser verify that it is communicating with the intended server.

2. Full Simple ASP.NET Core Program

Program.cs

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddControllers();

var app = builder.Build();


// Production security
if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/error");

    app.UseHsts();
}


// Redirect HTTP requests to HTTPS
app.UseHttpsRedirection();

app.UseAuthentication();

app.UseAuthorization();

app.MapControllers();

app.Run();

The two important middleware calls are:

app.UseHttpsRedirection();

and:

app.UseHsts();

They solve related but different problems.

3. What Does HTTPS Protect?

Suppose Angular sends login information:

{
  "username": "syed",
  "password": "MyPassword"
}

Without HTTPS, communication over an untrusted network can potentially be observed or tampered with.

Conceptually:

Browser
   |
   | username/password
   |
   v
Network
   |
   | potentially observable
   v
Server

With HTTPS:

Browser
   |
   | TLS encrypted connection
   |
   | username/password
   |
   v
Network
   |
   | encrypted traffic
   v
Server

An intermediary can still observe some connection metadata, but not normally the HTTP request/response contents protected by TLS.

4. HTTPS Protects Sensitive Data in Transit

HTTPS protects data such as:

Passwords
Authentication cookies
API requests
API responses
Personal information
JWT access tokens
Refresh tokens
Form data

For example:

Authorization: Bearer eyJhbGciOi...

should only be transmitted over HTTPS.

Likewise, an authentication cookie should normally have:

Secure

so that the browser only sends it over HTTPS.

5. What is UseHttpsRedirection()?

ASP.NET Core provides:

app.UseHttpsRedirection();

Its job is to redirect an HTTP request to the HTTPS endpoint.

For example:

http://www.example.com/products

becomes:

https://www.example.com/products

Conceptually:

Browser
   |
   | HTTP
   v
ASP.NET Core
   |
UseHttpsRedirection()
   |
   v
Redirect
   |
   v
Browser
   |
   | HTTPS
   v
ASP.NET Core

6. What is the Problem with HTTPS Redirection Alone?

Suppose the user manually enters:

http://www.example.com

The browser first sends an HTTP request.

Only after the server receives it can:

UseHttpsRedirection()

respond with a redirect.

So there is an initial HTTP interaction:

HTTP request
     ↓
Server
     ↓
Redirect
     ↓
HTTPS request

HSTS is designed to strengthen this situation for browsers that already know the site's HSTS policy.

7. What is HSTS?

HSTS stands for:

HTTP Strict Transport Security

HSTS tells the browser:

"For this site, use HTTPS only. Do not attempt ordinary HTTP connections during the policy lifetime."

The server sends a header such as:

Strict-Transport-Security: max-age=31536000

The browser remembers the policy.

Later, if the user enters:

http://www.example.com

the browser can internally upgrade it to:

https://www.example.com

before making an insecure HTTP request.

8. HTTPS Redirection vs HSTS

This is the key difference.

HTTPS Redirection

Browser
   |
   | HTTP request
   v
Server
   |
   | Redirect
   v
Browser
   |
   | HTTPS request
   v
Server

The HTTP request reached the server.

HSTS

Once the browser has learned the HSTS policy:

User enters:

http://example.com

       ↓

Browser knows HSTS

       ↓

Changes internally to:

https://example.com

       ↓

HTTPS request

The browser avoids making the ordinary HTTP request.

9. How Does HSTS Help Against Downgrade Attacks?

Consider an attacker trying to keep a victim on HTTP rather than HTTPS.

Without HSTS:

User
 ↓
HTTP
 ↓
Attacker/network
 ↓
Attempts to interfere
with HTTPS upgrade

With a previously learned HSTS policy:

User enters HTTP
       ↓
Browser checks HSTS
       ↓
HTTPS required
       ↓
HTTP connection avoided
       ↓
HTTPS

This helps mitigate SSL stripping / protocol downgrade scenarios.

10. ASP.NET Core HSTS

You enable HSTS using:

app.UseHsts();

You can configure it:

builder.Services.AddHsts(options =>
{
    options.MaxAge =
        TimeSpan.FromDays(365);

    options.IncludeSubDomains = true;
});

Then:

app.UseHsts();

The response can include something conceptually like:

Strict-Transport-Security:
max-age=31536000; includeSubDomains

11. What is max-age?

For example:

Strict-Transport-Security: max-age=31536000

max-age tells the browser how long, in seconds, it should remember the HSTS policy.

31536000 seconds
≈
365 days

During that period:

HTTP
 ↓
Browser upgrades/requires
 ↓
HTTPS

12. What is includeSubDomains?

Consider:

Strict-Transport-Security:
max-age=31536000; includeSubDomains

This extends the policy to subdomains.

For example:

example.com

api.example.com
admin.example.com
shop.example.com

Before enabling this option, make sure all relevant subdomains support HTTPS.

Otherwise, you can accidentally make HTTP-only subdomains inaccessible to users whose browsers have received the HSTS policy.

13. What is HSTS Preload?

There's still an important first-visit issue.

If a user has never visited the site before, their browser may not yet know its HSTS policy.

First visit

Browser
   |
   | Doesn't yet know HSTS
   |
   v
Potential HTTP request

Some sites address this using browser HSTS preload lists.

A qualifying domain can request inclusion in a browser-maintained list so the browser knows before the first visit that the domain should use HTTPS.

Conceptually:

Browser installed
      ↓
Already contains
HSTS preload information
      ↓
User enters HTTP
      ↓
Browser knows HTTPS required
      ↓
HTTPS

Preloading has strict operational implications, especially when subdomains are involved, so it should be adopted deliberately.

14. Why Isn't HSTS Normally Used During Development?

A common ASP.NET Core pattern is:

if (!app.Environment.IsDevelopment())
{
    app.UseHsts();
}

HSTS policies are cached by browsers.

During local development, persistent HTTPS-only browser behavior can make certificate and endpoint troubleshooting inconvenient.

Therefore:

Development
    ↓
Usually no HSTS

Production
    ↓
HSTS

Local HTTPS can still be used without enabling HSTS.

15. HTTPS + Angular + ASP.NET Core

Suppose:

Angular
https://www.example.com

ASP.NET Core
https://api.example.com

Communication should be:

Angular
   |
   | HTTPS
   | HttpClient
   v
ASP.NET Core API
   |
   | HTTPS
   v
Response

Avoid production configurations where the Angular application loads over HTTPS but attempts to call:

http://api.example.com

Browsers can block such mixed content.

Use:

https://api.example.com

16. HTTPS and Cookies

HTTPS should be combined with secure cookie settings.

For example:

options.Cookie.HttpOnly = true;

options.Cookie.SecurePolicy =
    CookieSecurePolicy.Always;

options.Cookie.SameSite =
    SameSiteMode.Lax;

Secure

Secure = true

means the browser sends the cookie only over HTTPS.

HttpOnly

HttpOnly = true

prevents ordinary JavaScript from reading the cookie.

These settings address different risks.

17. Does HTTPS Prevent XSS?

No.

HTTPS protects:

Browser
   ↕
Network
   ↕
Server

XSS occurs in the application/browser context:

Malicious content
       ↓
Application renders it unsafely
       ↓
JavaScript executes

An XSS attack can occur on a perfectly valid HTTPS website.

Therefore:

HTTPS ≠ XSS protection

18. Does HTTPS Prevent CSRF?

No.

HTTPS encrypts the forged request too.

For example:

Attacker
   ↓
Tricks browser
   ↓
HTTPS request
   ↓
Authentication cookie
   ↓
Server

The connection can be perfectly encrypted while the request itself is unwanted.

Therefore cookie-authenticated applications still need appropriate CSRF defenses.

19. Does HTTPS Replace Authentication?

No.

HTTPS answers roughly:

Can we communicate securely with the intended server over the network?

Authentication answers:

Who is this user/client?

Authorization answers:

What is this authenticated identity allowed to do?

So:

HTTPS
      +
Authentication
      +
Authorization
      +
XSS protection
      +
CSRF protection
      +
CSP

are complementary security layers.

20. HTTPS vs HSTS

Feature HTTPS HSTS
Full form HTTP Secure HTTP Strict Transport Security
Main purpose Secure network communication Require HTTPS for a site
Encrypts traffic Yes, via TLS No—HSTS itself doesn't encrypt
Uses certificate Yes Relies on HTTPS/TLS
Helps prevent HTTP downgrade HTTPS alone doesn't enforce future HTTPS-only use Yes
Browser remembers policy Not as the core mechanism Yes
ASP.NET Core HTTPS endpoint UseHsts()

The critical point:

HSTS does not replace HTTPS. HSTS tells the browser to insist on HTTPS.

21. UseHttpsRedirection() vs UseHsts()

Another common interview question:

UseHttpsRedirection()

app.UseHttpsRedirection();

Redirects:

HTTP
 ↓
HTTPS

but the initial HTTP request can reach the server.

UseHsts()

app.UseHsts();

sends the HSTS header so supporting browsers remember:

This site must use HTTPS

and subsequently avoid ordinary HTTP connections during the policy lifetime.

They are commonly used together.

22. Typical Production Configuration

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddControllers();

builder.Services.AddHsts(options =>
{
    options.MaxAge =
        TimeSpan.FromDays(365);

    options.IncludeSubDomains = true;
});

var app = builder.Build();

if (!app.Environment.IsDevelopment())
{
    app.UseHsts();
}

app.UseHttpsRedirection();

app.UseAuthentication();

app.UseAuthorization();

app.MapControllers();

app.Run();

Conceptually:

                  Browser
                     |
                     v
                 HTTPS/TLS
                     |
                     v
               ASP.NET Core
                     |
        +------------+------------+
        |                         |
UseHttpsRedirection()         UseHsts()
        |                         |
HTTP → HTTPS             Tell browser to
                         require HTTPS

23. Key Points

HTTPS

  • Uses TLS.
  • Encrypts HTTP traffic in transit.
  • Provides integrity protection.
  • Authenticates the server using certificates.
  • Protects passwords, cookies, JWTs and API data while transmitted.

HSTS

  • Means HTTP Strict Transport Security.
  • Delivered using the Strict-Transport-Security header.
  • Tells browsers to use HTTPS only for the specified period.
  • Helps mitigate protocol downgrade/SSL-stripping scenarios.
  • Commonly enabled in production.

ASP.NET Core

app.UseHttpsRedirection();

redirects HTTP requests to HTTPS.

app.UseHsts();

adds/enables HSTS behavior.

Interview Questions and Answers

1. What is HTTPS?

Answer: HTTPS is HTTP secured using TLS. It provides confidentiality and integrity for data in transit and authenticates the server using certificates.

2. What is HSTS?

Answer: HSTS stands for HTTP Strict Transport Security. It tells browsers to access a site only through HTTPS for a specified period.

3. What does UseHttpsRedirection() do?

Answer: It redirects incoming HTTP requests to the corresponding HTTPS endpoint.

app.UseHttpsRedirection();

4. What does UseHsts() do?

Answer: It enables sending the HSTS policy so browsers remember that the site should only be accessed through HTTPS.

app.UseHsts();

5. HTTPS redirection vs HSTS?

Answer: HTTPS redirection occurs after an HTTP request reaches the server. HSTS allows a browser that already knows the policy to upgrade/reject HTTP before making the insecure request.

6. Does HSTS encrypt traffic?

No. TLS/HTTPS performs encryption. HSTS tells the browser to require HTTPS.

7. Does HTTPS prevent XSS?

No. HTTPS protects data in transit. XSS is an application/browser content-injection vulnerability.

8. Does HTTPS prevent CSRF?

No. A forged request can still be sent over HTTPS. Cookie-authenticated applications still need appropriate CSRF defenses.

9. Why is HSTS normally enabled only in production?

Because browsers cache HSTS policies, which can complicate local development and certificate troubleshooting.

Interview Quick Answer

HTTPS uses TLS to encrypt communication between the Angular client and ASP.NET Core server, protecting the confidentiality and integrity of passwords, cookies, tokens, API requests, and responses in transit. UseHttpsRedirection() redirects HTTP requests to HTTPS. HSTS adds the Strict-Transport-Security policy, telling browsers to use HTTPS only for the site and helping prevent downgrade/SSL-stripping attacks. HSTS complements HTTPS; it does not replace it.

Keep Learning - More From This Category

← Back to Articles