“RESPONSE_Strict_Transport_Security”服务器变量用于在IIS中强制使用SSL

因此，我在其他答案和其他站点中看到了此解决方案（http://www.hanselman.com/blog/HowToEnableHTTPStrictTransportSecurityHSTSInIIS7.aspx），但我不明白如何添加HSTS标头。我认为它有很多与此有关：“RESPONSE_Strict_Transport_Security”服务器变量用于在IIS中强制使用SSL

<match serverVariable="RESPONSE_Strict_Transport_Security" pattern=".*" />

有人能解释其中“RESPONSE_Strict_Transport_Security”是哪里来的？

全码：

<?xml version="1.0" encoding="UTF-8"?> 
<configuration> 
    <system.webServer> 
     <rewrite> 
      <rules> 
       <rule name="HTTP to HTTPS redirect" stopProcessing="true"> 
        <match url="(.*)" /> 
        <conditions> 
         <add input="{HTTPS}" pattern="off" ignoreCase="true" /> 
        </conditions> 
        <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" 
         redirectType="Permanent" /> 
       </rule> 
      </rules> 
      <outboundRules> 
       <rule name="Add Strict-Transport-Security when HTTPS" enabled="true"> 
        <match serverVariable="RESPONSE_Strict_Transport_Security" 
         pattern=".*" /> 
        <conditions> 
         <add input="{HTTPS}" pattern="on" ignoreCase="true" /> 
        </conditions> 
        <action type="Rewrite" value="max-age=31536000" /> 
       </rule> 
      </outboundRules> 
     </rewrite> 
    </system.webServer> 
</configuration>

来源

2017-02-17 Denis D