[mguillemot]

It's worth noting that Rails enables HSTS for the whole domain when you use the following in one of your config files (usually production.rb):

    config.force_ssl = true

[ch0wn]

And for Flask users there is flask-sslify[0] by Kenneth Reitz for this.

[0] https://github.com/kennethreitz/flask-sslify

[Kudos]

I presume something like this is only useful for services like Heroku where you can't set it in your webserver directly?

[MichaelGG]

It's also useful if your app requirements trump deployment requirements. You might want a particular app to always require SSL, regardless of how it is deployed.