3 ms·
> facebook.com / max-age=15552000; preload That is a really weird value. It fails two of the three requirements for the HSTS header value specified at <https:/
by chrismorgan 3y ago
> facebook.com / max-age=15552000; preload
That is a really weird value. It fails two of the three requirements for the HSTS header value specified at <https://hstspreload.org/ https://hstspreload.org/>:
> 1. The max-age must be at least 31536000 seconds (1 year).
> 2. The includeSubDomains directive must be specified.
> 3. The preload directive must be specified.
It doesn’t even comply with their rules for grandfathered entries, which only lower the minimum max-age, but still require includeSubDomains. Yet it’s still in the list. ¯\_(ツ)_/¯
- toast0 3y agoIt's hard to find the history, but facebook is on the preload list by the great grandfathered method: they asked the chrome team to be added prior to the existance of the hsts preload submission site. It's been forever since I looked at the config file, but last time I looked, FB had hand configured CA pinning as well. Disclosure: I worked at WhatsApp until 2019, and was the person who submitted whatsapp domains to the preload site after I setup hsts headers on them. I think WhatsApp domains should be in the FB CA pinning config now, but I'm not 100% sure, and don't really want to try to find the preload config file to check.
- tiffanyh 3y agoIs this what you are referring too? https://chromium.googlesource.com/chromium/src/+/refs/heads/main/net/http/transport_security_state_static_pins.json https://chromium.googlesource.com/chromium/src/+/refs/heads/...