Enforcing HTTPS and enabling HSTS header in Spring security config, see more in https://blog.gypsyengineer.com/en/security/tips-configuring-security-rest-api-spring.html

ChannelSecurityConfig.java

@Configuration
@EnableWebSecurity
public class ChannelSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.requiresChannel().anyRequest().requiresSecure();
        http.headers().httpStrictTransportSecurity();
        // ...
    }
}