HSTS in ASP.NET Core: Stop SSL Stripping and HTTP Downgrade Attacks

Most teams treat HTTPS as the finish line for transport security. You install a certificate, force HTTPS redirection, watch the padlock appear, and move on. In production I have watched that assumptio