Enable HTTP Strict Transport Security (HSTS) with spring boot application

Question

I have followed the article https://docs.spring.io/spring-security/site/docs/4.0.2.RELEASE/reference/html/headers.html#headers-hsts to enable HSTS header on my spring boot a

Answer 1

It will only appear after the first request via HTTPS.

Answer 2

In accordance with RFC6797, the HSTS header is only injected into HTTPS responses.

Source: https://docs.spring.io/spring-security/site/docs/4.0.2.RELEASE/reference/htmlsingle/#headers-hsts