Subject: [websec] #37: Clarify that superdomain HSTS flag does not update max-age of subdomain's HSTS max-age and vice versa

From: "websec issue tracker" <[email-masked]>
Date: Sun, 11 Mar 2012 16:47:15 -0000

#37: Clarify that superdomain HSTS flag does not update max-age of subdomain's
HSTS max-age and vice versa

 The case is the following: A UA notes a superdomain e.g. example.com as a
 Known HSTS Host, with "includeSubDomains". Then after that the UA also
 receives a HSTS header from subdomain foo.example.com (with or without
 "includeSubDomains") and new max-age (longer or shorter time).
 The point is in that case the HSTS timer of the superdomain (example.com)
 MUST NOT be changed (extended or shortened) to the timer used in the
 subdomain.
 In fact the UA MUST keep both timers in cache independently and if at some
 point either one of them is removed (be due to expiry or because of an
 update setting max-age=0), the second remaining HSTS value MUST still be
 kept intact and applied. This is mainly to prevent that a subdomain can
 invalidate the HSTS flag of the superdomain or make it expire and vice
 versa.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |      Owner:  draft-ietf-websec-strict-transport-
  tobias.gondrom@…       |  sec@…
     Type:  enhancement  |     Status:  new
 Priority:  major        |  Milestone:
Component:  strict-      |    Version:
  transport-sec          |   Keywords:
 Severity:  -            |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/websec/trac/ticket/37>
websec <http://tools.ietf.org/websec/>