We are running a .net 5 web app.

We use both UseStaticFiles and UseHsts in our app Configure() at startup.

I can access my static files.

All my API/dynamic web endpoints have the HSTS headers.

My static files do not have the HSTS headers.

We have some static HTML files used in a SPA app and the pen tests we run are triggering vulnerabilities on it when it scans.

How can i configure my static files to use HSTS headers.

// Simplified example
public void Configure(
    IApplicationBuilder app,
    IHostApplicationLifetime appLifetime
)
{
    app.UseStaticFiles();
    app.UseHsts();
    app.UseRouting();
    app.UseCors();
    app.UseAuthentication();

    app.UseEndpoints(endpoints => {
        endpoints.MapControllers();
        endpoints.MapHealthChecks("/healthcheck");
    });
}

Update based on @gjhommersom awnser

Configuring the app like this instead adds cors to the headers.

However the strict-transport-security header is still missing :(

// Simplified example
public void Configure(
    IApplicationBuilder app,
    IHostApplicationLifetime appLifetime
)
{
    app.UseHsts();
    app.UseRouting();
    app.UseCors();
    app.UseAuthentication();

    app.UseEndpoints(endpoints => {
        endpoints.MapControllers();
        endpoints.MapHealthChecks("/healthcheck");
    });
    app.UseStaticFiles();
}