title: Spring Strict Transport Security (HSTS) configuration not working
body: <p>I'm trying to enable HSTS in my Spring Boot application. I've added the following to my WebSecurityConfig (based on <a href="https://stackoverflow.com/questions/50511702/enable-http-strict-transport-security-hsts-with-spring-boot-application/53522560#53522560">Enable HTTP Strict Transport Security (HSTS) with spring boot application</a>):</p>
  
  <pre class="lang-java prettyprint-override"><code>@Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter
  {
      protected void configure(HttpSecurity http) throws Exception
      {
          // Other http configurations, e.g. authorizeRequests and CSRF
          // ...
  
          http.headers().httpStrictTransportSecurity()
              .maxAgeInSeconds(Duration.ofDays(365L).getSeconds())
              .includeSubDomains(true);
      }
  }
  </code></pre>
  
  <p>I <em>do</em> get the <code>strict-transport-security</code> header when in HTTPS requests, but the max-age is always <code>0</code>:</p>
  
  <pre><code>strict-transport-security: max-age=0; includeSubDomains
  </code></pre>
  
  <p>I'm getting the exact same header if I <em>don't</em> add the Spring configuration, so it looks my configuration is not being picked up. It appears to be specific to the HSTS configuration, because the other configurations, e.g. <code>http.authorizeRequests()</code>, are working. That seems to indicate that the HSTS configuration is somehow being overwritten, especially when considering that <a href="https://docs.spring.io/spring-security/site/docs/4.0.2.RELEASE/reference/htmlsingle/#headers-hsts" rel="nofollow noreferrer">Spring's default</a> max-age is one year. However, I've been able to find any other HSTS-related configuration in our codebase.</p>
  
  <p>I also tried setting a breakpoint in <code>o.springframework.s.c.a.w.c.HeadersConfigurer.HstsConfig#maxAgeInSeconds</code> to check whether it's being called more than once. My call from <code>configure</code> was the only invocation.</p>
  
  <p>Does anyone know why my HSTS configuration is not used? Or do you have any other ideas on how to debug this?</p>