3 ms·
Woo, I get an A+. Do you have any comments on using 'includeSubDomains' with HTST? I've had some people tell me not to use it and other to use it. Are there any
by aroch 13y ago
Woo, I get an A+. Do you have any comments on using 'includeSubDomains' with HTST? I've had some people tell me not to use it and other to use it. Are there any major security implications?
- ivanr 13y agoIdeally, you should always use "includeSubdomains" with HSTS. This will provide robust security for the main hostname as well as all subdomains. The issue here is that (without "includeSubdomains") a man in the middle attacker can create arbitrary subdomains and use them inject cookies into your application. In some cases, even leakage might occur. The drawback of "includeSubdomains", of course, is that you will have to deploy all subdomains over SSL.
- aroch 13y agoThanks, that's what I thought.