What is HTTP Strict Transport Security (HSTS)?
A response header that obliges browsers to use HTTPS only for a domain, blocking protocol-downgrade attacks. BYOB’s Traefik edge already redirects port 80 to 443, and HSTS pins that behavior client-side.
Related terms
HTTPS
Encrypted HTTP via TLS, a lightweight ranking signal and a trust requirement. Mixed HTTP resources on HTTPS pages still split signals and trigger browser warnings.
HTTPS Redirect & Security Defaults
Port-80-to-443 redirection with HSTS/CSP inherited from the edge. Generated apps get transport security by platform default, not per-project configuration.
Content Security Policy
An HTTP response header that whitelists exactly which origins may supply scripts, styles, and frames. A tight policy neuters injected payloads even after an XSS bug ships.
Cross-Site Request Forgery (CSRF)
An attack that tricks a logged-in browser into submitting unwanted state-changing requests to a trusted site. SameSite cookies, anti-CSRF tokens, and origin checks break the forgery chain.
SQL Injection
An attack that smuggles database commands through unsanitized input into application queries. Parameterized statements and least-privilege database roles keep hostile input as data, never executable code.
CSP Directives
The individual rules inside a Content Security Policy, such as script-src, object-src, and frame-ancestors. Each directive narrows one resource class, so auditing means reviewing directives one by one.