The most effective way to redirect network traffic is to use a permanent redirection. This way, search engines and users can easily redirect to the website under HTTPS from an HTTP request. In many cases, this technique cannot guarantee safe traffic for your users. Redirection from HTTP to HTTPS can be abused by attackers for phishing attacks and can be redirected to a different host without any proper validation of user parameter by preventing HTTP Strict Transport Security. HSTS is a web security that ensures a secure connection between a server and its client.
Using this vulnerability, an attacker can:-
According to Beagle, a secure connection can be achieved by using a response header field named Strict-Transport-Security.
A universal and straightforward technique is to configure the server to redirect to HTTPS. By this technique, when the server sends HTTPS to the client. The client sends HSTS and other attributes to the server. The initial response is always unsure/unsafe.
The above code sets all the subdomain connections as secure.