3 ms·
It's worth noting, that if you can, you should include the "includeSubDomains" flag with STS: Strict-Transport-Security: max-age=604800, includeSubDomains T
by mike-cardwell 15y ago
It's worth noting, that if you can, you should include the "includeSubDomains" flag with STS:
Strict-Transport-Security: max-age=604800, includeSubDomains
The reason for this is, somebody controlling the network could create a fake DNS A record for "foobar.news.ycombinator.com", and then stick this into the html of another unrelated non-https page that you go to:
<img src="http://foobar.news.ycombinator.com/">
Which then may leak the news.ycombinator.com cookie over http, as the STS would only have applied to news.ycombinator.com and not foobar.news.ycombinator.com