Enable Strict transport security mvc - asp.net-mvc

Question

I want to enable strict transport security.
MY website is a https enable.
Below is my code to enable hsts.
<system.webServer>
<httpProtocol>
<customHeaders>
<add name="X-Frame-Options" value="SAMEORIGIN" />
**<add name="Strict-Transport-Security" value="max-age=31536000"/>**
.....
</customHeaders>
</httpProtocol>
Is above setting is enough to make strict transport security enable or do i also need to add below setting ie.
<rewrite>
<rules>
<rule name="HTTP to HTTPS redirect" stopProcessing="true">
<match url="(.*)" />
<conditions>
<add input="{HTTPS}" pattern="off" ignoreCase="true" />
</conditions>
<action type="Redirect" url="https://{HTTP_HOST}/{R:1}"
redirectType="Permanent" />
</rule>
</rules>
<outboundRules>
<rule name="Add Strict-Transport-Security when HTTPS" enabled="true">
<match serverVariable="RESPONSE_Strict_Transport_Security"
pattern=".*" />
<conditions>
<add input="{HTTPS}" pattern="on" ignoreCase="true" />
</conditions>
<action type="Rewrite" value="max-age=31536000" />
</rule>
</outboundRules>
</rewrite>
If both setting are mandatory then what is the need for rewrite
can we enable hsts by only
or by only
rewrite .
Why rewrite is required.
This site says to add rewrite alogn with
<add name="Strict-Transport-Security" value="max-age=31536000"/>

Answer 1

This header force the browser to use HTTPS. If the application has HTTP link given somewhere or if the user tries to enter URL with HTTP, the browser will redirect him to https. To use HSTS, the site need valid SSL certificate. The rewrite is not mandatory, but its good to have. Because, if the user first enter the site with https, then whenever he comes to the site, user will be automatically redirected until expiry, also the max age updates on each visit. But if user enters once in http mode, the STS may not work until he use the site in https once. Its better to use the rewrite.
<system.webServer>
<httpProtocol>
<customHeaders>
<add name="Strict-Transport-Security" value="max-age=xxxxxx"/>
</customHeaders>
</httpProtocol>
</system.webServer>
https://www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security