HSTS header

Help
1

Hi,

Struggling with a HSTS header (Strict-Transport-Security).

I picked up a codebase which had the STS header set in the next.config.js as:

    // next.config.js
    // other headers etc
    {
        key: "Strict-Transport-Security",
        value: "max-age=63072000; includeSubDomains; preload",
    }

However, none of the headers from this existing file were visible in the production response - This seemed good as we don’t want “includeSubDomains” or “preload” and want to set the max-age to 1 year anyway.

  1. Removed the headers from the next.config entirely.

  2. Attempted to set these using the vercel.json and all of the headers were visible - However, the STS header was set to it’s original values above.

  3. Tried again with middleware and see the same result.

    // vercel.json
    // other headers etc
    {
        key: "Strict-Transport-Security",
        value: "max-age=31536000",
    }

I’ve deleted HSTS data from my browsers, incog, removing the header entirely from code and all of the recommended fixes from searches.

Some edge level caching? I don’t really know how it all works to be honest.

Any help appreciated.