title: Why Spring Security HSTS header, is being removed by app engine?
body: <p>I have a rather simple spring boot application run on the GCP app engine.</p>
  <p>I enabled spring security to get the default security response headers on the API's endpoint.</p>
  <p>Now I have all of the default headers except the HSTS when I deploy the app into the app-engine.</p>
  <p>I created a self-signed cert to test the app locally and it returned the HSTS headers, no problem there. but when I deploy the app into the app-engine of all the headers HSTS is missing.</p>
  <p>Here is <strong>app.yaml</strong>: (*in which I redirect all HTTP requests into HTTPS and also tried the HTTP to HTTPS redirection in app-level via configuration but not different *)</p>
  <pre><code>runtime: java11
  instance_class: F4
  
  handlers:
    - url: /.*
      script: auto
      secure: always
      redirect_http_response_code: 301
  </code></pre>
  <p>Here is the <strong>WebSecurityConfig</strong> file: (<em>And I know that there is no need to explicitly configure HSTS in here to get the default but with or without it does not work</em>)</p>
  <pre><code>@Configuration
  @EnableWebSecurity
  @RequiredArgsConstructor
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class WebSecurityConfig extends
          WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.headers().httpStrictTransportSecurity()
                  .maxAgeInSeconds(31536000)
                  .includeSubDomains(true);
      }
  }
  </code></pre>
  <p>Here is the main:</p>
  <pre><code>@RestController
  @SpringBootApplication
  public class XXXApplication {
  
      public static void main(String[] args) {
          SpringApplication.run(XXXApplication.class, args);
      }
  
      @GetMapping(&quot;/&quot;)
      public ModelAndView suspended(@RequestParam(required = false, defaultValue = &quot;This&quot;) String name) {
          /// some stuff ...
      }
  
  }
  </code></pre>
  <p>I know that the only way to set HSTS header via app-engine and in the app.yaml is when you want to serve static content which is not my case.</p>
  <p>Can someone please help me with this? I am not sure what I missed and why HSTS is the only header that I am not getting in response after deploying into the app-engine?</p>