「RESPONSE_Strict_Transport_Security」服務器變量用於在IIS中強制使用SSL

因此，我在其他答案和其他站點中看到了此解決方案（http://www.hanselman.com/blog/HowToEnableHTTPStrictTransportSecurityHSTSInIIS7.aspx），但我不明白如何添加HSTS標頭。我認爲它有很多與此有關：「RESPONSE_Strict_Transport_Security」服務器變量用於在IIS中強制使用SSL

<match serverVariable="RESPONSE_Strict_Transport_Security" pattern=".*" />

有人能解釋其中「RESPONSE_Strict_Transport_Security」是哪裏來的？

全碼：

<?xml version="1.0" encoding="UTF-8"?> 
<configuration> 
    <system.webServer> 
     <rewrite> 
      <rules> 
       <rule name="HTTP to HTTPS redirect" stopProcessing="true"> 
        <match url="(.*)" /> 
        <conditions> 
         <add input="{HTTPS}" pattern="off" ignoreCase="true" /> 
        </conditions> 
        <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" 
         redirectType="Permanent" /> 
       </rule> 
      </rules> 
      <outboundRules> 
       <rule name="Add Strict-Transport-Security when HTTPS" enabled="true"> 
        <match serverVariable="RESPONSE_Strict_Transport_Security" 
         pattern=".*" /> 
        <conditions> 
         <add input="{HTTPS}" pattern="on" ignoreCase="true" /> 
        </conditions> 
        <action type="Rewrite" value="max-age=31536000" /> 
       </rule> 
      </outboundRules> 
     </rewrite> 
    </system.webServer> 
</configuration>

來源

2017-02-17 Denis D