Subject: Re: [websec] HSTS: max-age=0 interacting with includeSubdomains

From: =JeffH <[email-masked]>
Date: Tue, 21 Aug 2012 17:14:37 -0700

Tobias asked:
 >
 > the case in question is: does HSTS with max-age=0 and includeSubDomains
 > mean you remove the HSTS flag (entry) for the subDomains as well ?

If you mean to ask whether a UA receiving this header from example.com..

   Strict-Transport-Security: max-age=0; includeSubDomains

..affects any _entries_ the UA may have in its HSTS list for subdomains of 
example.com, the answer is "no".

Also, receipt of the below header should be treated by the UA the same as 
receipt of the above header (where both headers are received from example.com)..

     Strict-Transport-Security: max-age=0

The intention is that receipt of an HSTS header field with "max-age=0" is 
treated the same regardless of the presence or absence of the includeSubDomains 
flag in the header field. The effect in both cases is to remove the entire entry 
for "example.com" from the UA's HSTS host list.

In other words, the UA maintains HSTS information indexed by hostname, and must 
receive an STS header from a given host (over a secure connection) in order to 
create, update, or delete HSTS info about the given host.

HTH,

=JeffH

---

From: =JeffH <[email-masked]>
Date: Tue, 21 Aug 2012 17:15:07 -0700

Brian Smith added..
 >
 > Tobias Gondrom wrote:
 >> Actually, the proposed text does not clarify it at all in my
 >> understanding. Maybe I did not make my point clear enough: the case in
 >> question is: does HSTS with max-age=0 and includeSubDomains mean you remove
 >> the HSTS flag (entry) for the subDomains as well (i.e. is this equivalent
 >> to receiving HSTS headers with max-age=0 for all subdomains)? You said "no"
 >> and that would be ok for me, but from the text you proposed this would
 >> still not be clear to me.
 >>
 >> Do you see what I mean?
 >
 > I agree that the proposed change doesn't really make things less confusing.

Perhaps you could suggest mods to -12 that would help clarify it from your 
perspective?

 > My understanding (based on this discussion) is that an HSTS header can only
 > modify the HSTS information for the same host that the HSTS header was
 > received on.

correct.

 > This means that the client should not modify any information for
 > sub.example.org based on information it receives from example.org,

correct.

 >  and it
 > should not modify any information for example.org based on information it
 > receives from sub.example.org.

correct.

 > When making a connection to a host, the client reads the entry for the given
 > host, and for all parent domains that have includeSubdomains in their HSTS
 > entries.

essentially correct.  Rather, the UA examines any superdomain host (aka parent 
domain hosts) entries it may have and if any of them have includeSubdomains 
asserted, then HSTS Policy applies to the given host; otherwise HSTS Policy 
applies to the given host if it is a Known HSTS Host to that UA. Step 5 in 
Section 8.3.

 > After receiving an HSTS header from a given host, the client updates the
 > entry for the given host only.

correct.

 > When receiving an HSTS header and updating the
 > database, the client should never traverse the parent/child domain
 > hierarchy.

correct.

HTH,

=JeffH