I have implemented the HSTS in my ASP.Net MVC based Website. But if I make a HTTP(not HTTPS) request, the request is propagating using the HTTP channel and the response is 301: Moved Permanently. And from the 2nd request onwards, it is communicating using HTTPS.
Is this the correct behavior of HSTS ? I am bit concerned about, if someone deliberately request for http traffic is it still accepting it (the first request).