Yeah this seems like some low-level detail that should really be outsourced to whatever library / framework / server you are using.

Should you keep it on then if you’re using SSL?