Search code examples
httpsecurityhttpresponsehsts

why google.com not set includeSubDomains directive on HSTS response header?

why google.com not set includeSubDomains directive on http strict transport security response header ?

google.com HSTS resonse header is something like:

Strict-Transport-Security:max-age=86400

Why not 

Strict-Transport-Security: max-age=86400; includeSubDomains

The second one should be more secure from my side, is that right ??

Solution

  • It is static

    Using Google Chrome, you can go to chrome://net-internals/#hsts and Query different domains. Entering google.com and clicking on Query will bring back a list of results.

    In that result list, you can see that static_sts_include_subdomains is true and dynamic_sts_include_subdomains is false. This is better than setting it dynamically, which is vulnerable to an attack whereby the very first time the browser requests the domain with http:// (not https://) an adversary intercepts the communication. In order to overcome this weakness we have the static mode which allows for hard-coding HSTS records directly into the browser's source.

    Hope this helps