What is the difference between UseHttpsRedirection and UseHsts

We recommend all production ASP.NET Core web apps call: The HTTPS Redirection Middleware ( UseHttpsRedirection ) to redirect all HTTP requests to HTTPS. UseHsts , HTTP Strict Transport Security Protocol (HSTS). ASP.NET Core Enforce HTTPS. The . UseHttpsRedirection () will issue HTTP response codes

UseHsts adds the Strict-Transport-Security header to the response, which informs the browser that the application must only be accessed with HTTPS. After this declaration, compliant browsers should automatically convert any http request of the application into an HTTPS request.

UseHttpsRedirection causes an automatic redirection to HTTPS URL when an HTTP URL is received, in a way that forces a secure connection.

Once the first HTTPS secure connection is established, the strict-security header prevents future redirections that might be used to perform man-in-the-middle attacks.

According to the documentation you should use both together:

We recommend all production ASP.NET Core web apps call:

• The HTTPS Redirection Middleware (UseHttpsRedirection) to redirect all HTTP requests to HTTPS.
• UseHsts, HTTP Strict Transport Security Protocol (HSTS).

ASP.NET Core Enforce HTTPS

The .UseHttpsRedirection() will issue HTTP response codes redirecting from http to https. The .UseHsts() will add the HSTS response header which the client is supposed to obey.