5 ms·
IMO, too many of these websites recommend includeSubdomains as part of the HSTS stanza right out the gate. Personally, I'd deploy HSTS incrementally and wait u
by newman314 10y ago
IMO, too many of these websites recommend includeSubdomains as part of the HSTS stanza right out the gate.
Personally, I'd deploy HSTS incrementally and wait until such time there is a majority of subdomains that are TLS capable before deploying includeSubDomains. Otherwise, there could likely be some nasty surprises.
- aianus 10y agoYou can't get on the HSTS preload list included with browsers without includeSubDomains.
- newman314 10y agoTo clarify, most of the customers I deal with are enterprise customers and so as such have many internet facing hostnames/domains/subdomains. Arbitrarily enabling includeSubDomains is going to lead to nasty surprises if there is no prior coordination.
- hunter2_ 10y ago> majority I'd argue that all, not most, subdomains must be HTTPS capable (I won't say TLS generally, either; this is only dealing with HTTP). Any that aren't will not be accessible by a user agent that recently (within the max-age) visited the parent domain if it had an HSTS header with that flag.