@SuppressWarnings("checkstyle:MagicNumber")
    @Override
    protected void postHandle(ServletRequest request, ServletResponse response) {
        if (hsts.isEnabled()) {
            StringBuilder directives = new StringBuilder(64)
                    .append("max-age=").append(hsts.getMaxAge());

            if (hsts.isIncludeSubDomains()) {
                directives.append("; includeSubDomains");
            }

            HttpServletResponse resp = (HttpServletResponse) response;
            resp.addHeader(HSTS.HTTP_HEADER, directives.toString());
        }
    }
If HTTP Strict Transport Security (HSTS) is enabled the HTTP header
will be written, otherwise this method does nothing.

@param request  the incoming {@code ServletRequest}
@param response the outgoing {@code ServletResponse}
web/src/main/java/org/apache/shiro/web/filter/authz/SslFilter.java