<p>An action item from the <strong>security scan</strong> is to implement <strong>HSTS</strong> header in ASP.Net Core 6.0 WebAPI.</p>
<p>A WebAPI application is deployed on AKS using Application Gateway Ingress Controller. SSL termination occurs at the Application Gateway. Application Gateway Ingress Controllers and PODs communicate using HTTP.</p>
<p><a href="https://i.stack.imgur.com/mF57L.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/mF57L.png" alt="enter image description here" /></a></p>
<p>In this case, is it necessary to implement HSTS? In that case, what infrastructure requirements are needed?</p>

<p>The <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security" rel="nofollow noreferrer">HSTS header</a> is a browser only instruction. It informs browsers that the site should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically be converted to HTTPS.</p>
<blockquote>
<p>In this case, is it necessary to implement HSTS?</p>
</blockquote>
<p>If your application hosted in AKS is a web application which will load in browser then, yes. However, as you mentioned, if it is only an API then it does not make much sense.</p>
<p>This is also <a href="https://learn.microsoft.com/en-us/aspnet/core/security/enforcing-ssl?view=aspnetcore-6.0&amp;tabs=visual-studio" rel="nofollow noreferrer">documented on MSDN</a>:</p>
<blockquote>
<p>HSTS is generally a browser only instruction. Other callers, such as
phone or desktop apps, do not obey the instruction. Even within
browsers, a single authenticated call to an API over HTTP has risks on
insecure networks. The secure approach is to configure API projects to
only listen to and respond over HTTPS.</p>
</blockquote>
<p>That said, assuming your application is a web application, to implement it with AGIC, you will have to first configure rewrite ruleset on the app gateway. This can be done from portal or with PowerShell:</p>
<pre><code># Create RuleSet
$responseHeaderConfiguration = New-AzApplicationGatewayRewriteRuleHeaderConfiguration -HeaderName &quot;Strict-Transport-Security&quot; -HeaderValue &quot;max-age=31536000; includeSubDomains; preload&quot; 
$actionSet = New-AzApplicationGatewayRewriteRuleActionSet -ResponseHeaderConfiguration $responseHeaderConfiguration 
$rewriteRule = New-AzApplicationGatewayRewriteRule -Name HSTSHeader -ActionSet $actionSet
$rewriteRuleSet = New-AzApplicationGatewayRewriteRuleSet -Name SecurityHeadersRuleSet -RewriteRule $rewriteRule

# apply the ruleset to your app gateway
$appgw = Get-AzApplicationGateway -Name &quot;yourgw&quot; -ResourceGroupName &quot;yourgw-rg&quot;
Add-AzApplicationGatewayRewriteRuleSet -ApplicationGateway $appgw -Name $rewriteRuleSet.Name  -RewriteRule $rewriteRuleSet.RewriteRules
Set-AzApplicationGateway -ApplicationGateway $appgw
</code></pre>
<p>Next, to map the RuleSet to your ingress path, use the <a href="https://azure.github.io/application-gateway-kubernetes-ingress/annotations/#rewrite-rule-set" rel="nofollow noreferrer">annotation</a> on your ingress definition to reference the Ruleset:</p>
<pre><code>appgw.ingress.kubernetes.io/rewrite-rule-set: SecurityHeadersRuleSet
</code></pre>
