错误页面（400、401、403、500等）是否需要配置Strict-Transport-Security（HSTS）响应头？

Great question—this is a common detail that gets overlooked when setting up HSTS, so it’s awesome you’re digging into it to make your app more secure!

Short answer: Yes, you absolutely should include the HSTS header on every response from your server, regardless of the status code (200 OK, 404 Not Found, 500 Internal Server Error, etc.).

Here’s why this matters:

• HSTS’s core job is to train browsers to only use HTTPS for all future requests to your domain. If a browser hits a 500 error on its first visit to your site and doesn’t get the HSTS header, it might still allow fallback to HTTP on subsequent attempts—creating an opening for man-in-the-middle attacks.
• Browsers respect the HSTS header even when the response is an error. As long as the header is present, the browser will store your domain’s HSTS policy, ensuring all future requests skip HTTP entirely.
• Security tools (like OWASP ZAP or Nessus) will flag missing HSTS headers on error responses as a vulnerability, since it leaves a potential attack surface unprotected.

Practical Implementation Tip #

Instead of adding the HSTS header only to 200 OK responses, configure it globally at the server level to apply to all responses. For example:

• In Nginx, use the always keyword to ensure the header is sent with every status code:

  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
  

• In Apache, use the always directive for the same effect:

  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
  

This way, you don’t have to worry about missing any endpoints or response types—every request to your domain will enforce HTTPS going forward.

内容的提问来源于stack exchange，提问作者nicg