Package org.springframework.security.config.web.server

# Class ServerHttpSecurity.HeaderSpec.HstsSpec

java.lang.Object
org.springframework.security.config.web.server.ServerHttpSecurity.HeaderSpec.HstsSpec

Enclosing class:
  ServerHttpSecurity.HeaderSpec

public final class ServerHttpSecurity.HeaderSpec.HstsSpec extends Object
Configures Strict Transport Security response header

See Also:
  - `ServerHttpSecurity.HeaderSpec.hsts()`

## Method Summary

Modifier and Type
Method
Description
`ServerHttpSecurity.HeaderSpec`
`and()`
Deprecated, for removal: This API element is subject to removal in a future version.
For removal in 7.0.
`ServerHttpSecurity.HeaderSpec`
`disable()`
Disables strict transport security response header
`ServerHttpSecurity.HeaderSpec.HstsSpec`
`includeSubdomains(boolean includeSubDomains)`
Configures if subdomains should be included.
`ServerHttpSecurity.HeaderSpec.HstsSpec`
`maxAge(Duration maxAge)`
Configures the max age.
`ServerHttpSecurity.HeaderSpec.HstsSpec`
`preload(boolean preload)`
Configures if preload should be included.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Method Details

### maxAge

public ServerHttpSecurity.HeaderSpec.HstsSpec maxAge(Duration maxAge)
Configures the max age. Default is one year.

Parameters:
  `maxAge` - the max age
Returns:
  the `ServerHttpSecurity.HeaderSpec.HstsSpec` to continue configuring

### includeSubdomains

public ServerHttpSecurity.HeaderSpec.HstsSpec includeSubdomains(boolean includeSubDomains)
Configures if subdomains should be included. Default is true

Parameters:
  `includeSubDomains` - if subdomains should be included
Returns:
  the `ServerHttpSecurity.HeaderSpec.HstsSpec` to continue configuring

### preload

public ServerHttpSecurity.HeaderSpec.HstsSpec preload(boolean preload)

Configures if preload should be included. Default is false

See Website hstspreload.org for additional details.

Parameters:
  `preload` - if subdomains should be included
Returns:
  the `ServerHttpSecurity.HeaderSpec.HstsSpec` to continue configuring
Since:
  5.2.0

### and

@Deprecated(since="6.1", forRemoval=true) public ServerHttpSecurity.HeaderSpec and()
Deprecated, for removal: This API element is subject to removal in a future version.
For removal in 7.0. Use `ServerHttpSecurity.HeaderSpec.hsts(Customizer)` or `hsts(Customizer.withDefaults())` to stick with defaults. See the documentation for more details.
Allows method chaining to continue configuring the `ServerHttpSecurity`

Returns:
  the `ServerHttpSecurity.HeaderSpec` to continue configuring

### disable

public ServerHttpSecurity.HeaderSpec disable()
Disables strict transport security response header

Returns:
  the `ServerHttpSecurity.HeaderSpec` to continue configuring