@Override
    protected void decideInsertStrictTransportSecurityHeader(final HttpServletResponse httpServletResponse,
                                                             final HttpServletRequest httpServletRequest,
                                                             final Optional<RegisteredService> result) {
        val shouldInject = shouldHttpHeaderBeInjectedIntoResponse(result,
            RegisteredServiceProperties.HTTP_HEADER_ENABLE_STRICT_TRANSPORT_SECURITY);
        if (shouldInject.isPresent()) {
            if (shouldInject.get()) {
                val headerValue = StringUtils.defaultIfBlank(getStringProperty(result,
                    RegisteredServiceProperties.HTTP_HEADER_STRICT_TRANSPORT_SECURITY), getStrictTransportSecurityHeader());
                insertStrictTransportSecurityHeader(httpServletResponse, httpServletRequest, headerValue);
            } else {
                LOGGER.trace("StrictTransportSecurity header disabled by service definition");
            }
        } else {
            super.decideInsertStrictTransportSecurityHeader(httpServletResponse, httpServletRequest, result);
        }
    }
This is {@link RegisteredServiceResponseHeadersEnforcementFilter}. A filter extension that looks at the properties of a
registered service to determine if headers should be injected into the response.

@author Misagh Moayyed
@since 5.3.0
core/cas-server-core-web-api/src/main/java/org/apereo/cas/services/web/support/RegisteredServiceResponseHeadersEnforcementFilter.java