Enable Strict-Transport-Security on web app deployed on cloud run containers

[sristi_raj]

Hello Gurus,

I have a react web application deployed on cloud run and I am looking to enable HSTS headers in the response sent out from cloud run container to the browser while opening the application in browser.

Is there a way to enable custom headers in cloud run?

Regards,

Sristi Raj

[djs_75 · Accepted solution]

so with HSTS it is more about how you're servicing the domain than checking a box. You would implement Cloud Run behind CDN, an Endpoint or Apigee inorder to force the redirect to HTTPS (Strict-Transport-Security - HTTP | MDN (mozilla.org)) at the browser as Cloud Run is a backend service. Your service can also be built to pull the key from certificate manager and putting Cloud Run in a NEG behind a SSL Load Balancer Set up Cloud Run, Cloud Functions, or App Engine  |  Cloud CDN  |  Google Cloud. In all cases you would need to manage the domain name(Mapping custom domains  |  Cloud Run Documentation  |  Google Cloud) as cloud run deploys in the *run.app domain space and does not support custom headers at this time. If cloud run is internal only, Private Access and a Private Connect can be configured to enforce HTTPS with cloud run having a private DNS record - Context Aware and IAP policies can enforce the secure protocols and header requirements. 

[sristi_raj]

Thanks @djs_75 . This helps We have now started to run cloud run behind LB and enable HSTS in LB.