Implementing HTTP Strict-Transport-Security via MVC action filter
I would suggest setting the message on ArgumentException to your parameter name

e.g.

throw new ArgumentException("'duration' must be greater than 0");