Having implemented HTTPS support, we aren't completely done. As we said earlier, it's necessary for our users to use the HTTPS version of Notes, but as it stands they can still use the HTTP version. The Strict Transport Security header notifies the browser that it should use the HTTPS version of the site. Since that's simply a notification, it's also necessary to implement a redirect from the HTTP to HTTPS version of Notes.
We set the Strict-Transport-Security like so:
const sixtyDaysInSeconds = 5184000app.use(helmet.hsts({ maxAge: sixtyDaysInSeconds}));
This tells the browser to stick with the HTTPS version of the site for the next 60 days, and never visit the HTTP version.
And, as long as ...
