public void setHsts(HSTS hsts) {
        this.hsts = hsts;
    }
Filter which requires a request to be over SSL.  Access is allowed if the request is received on the configured
server {@link #setPort(int) port} <em>and</em> the
{@code request.}{@link javax.servlet.ServletRequest#isSecure() isSecure()}.  If either condition is {@code false},
the filter chain will not continue.
<p/>
The {@link #getPort() port} property defaults to {@code 443} and also additionally guarantees that the
request scheme is always 'https' (except for port 80, which retains the 'http' scheme).
<p/>
In addition, the filter allows enabling HTTP Strict Transport Security (HSTS).
This feature is opt-in and disabled by default. If enabled HSTS
will prevent <b>any</b> communications from being sent over HTTP to the
specified domain and will instead send all communications over HTTPS.
</p>
The {@link #getMaxAge() maxAge} property defaults {@code 31536000}, and
{@link #isIncludeSubDomains includeSubDomains} is {@code false}.
</p>
<b>Warning:</b> Use this setting with care and only if you plan to enable
SSL on every path.
</p>
Example configs:
<pre>
[urls]
/secure/path/** = ssl
</pre>
with HSTS enabled
<pre>
[main]
ssl.hsts.enabled = true
[urls]
/** = ssl
</pre>

@see <a href="https://tools.ietf.org/html/rfc6797">HTTP Strict Transport Security (HSTS)</a>
@since 1.0
web/src/main/java/org/apache/shiro/web/filter/authz/SslFilter.java