HSTS su un sottodominio con includeSubdomains

Basato sulla RFC, HTTP Transport Transport Security (HSTS) , gli stati includeSubDomains:

6.1.2. The includeSubDomains Directive

The OPTIONAL "includeSubDomains" directive is a valueless directive which, if present (i.e., it is "asserted"), signals the UA that the HSTS Policy applies to this HSTS Host as well as any subdomains of the host's domain name.

Pertanto la tua politica HSTS si applicherebbe solo a foo.example.com e *.foo.example.com

example.com e bar.example.com non verrebbero influenzati.

Per maggiori informazioni, c'è una bella discussione sui webmaster intitolata Ho bisogno di un certificato SSL con caratteri jolly per l'inclusione nell'elenco di precarico HSTS?

Dipende, la sezione 11.4.2 descrive lo scenario delle app web che interagiscono con i sottodomini ma non con l'host HSTS ( abc.domain.com ma non domain.com ) e in questo caso gli UA non applicheranno la politica HSTS. Il suggerimento è:

HSTS Hosts should be configured such that the STS header field is emitted directly at each HSTS Host domain or subdomain name that constitutes a well-known "entry point"

Ma la sezione 11.4.1 dice che tutti i sottodomini devono implementare HTTPS, quindi finché lo fanno Dovrebbe funzionare bene.

Dalla specifica:

If ca.example.com were to issue an HSTS Policy with the
includeSubDomains directive, then HTTP-based user agents implementing HSTS that have interacted with the ca.example.com web application
would fail to retrieve CRLs and fail to check OCSP for certificates,
because these services are offered over plain HTTP.

In this case, Example CA can either:

• not use the includeSubDomains directive, or

• ensure that HTTP-based services offered at subdomains of ca.example.com are also uniformly offered over TLS/SSL, or

• offer plain HTTP-based services at a different domain name, e.g., crl-and-ocsp.ca.example.NET, or

• utilize an alternative approach to distributing certificate status information, obviating the need to offer CRL distribution and OCSP services over plain HTTP (e.g., the "Certificate Status Request" TLS extension [RFC6066], often colloquially referred to as "OCSP Stapling").

Would the HSTS policy have any effect on domains such as example.com or bar.example.com?

Sì. includeSubDomains riguarda tutti i sottodomini del nome di dominio. Fondamentalmente, il nome di dominio di foo.example.com è example.com , quindi tutti gli agenti utente conformi applicheranno la restrizione HSTS a *.example.com .

6.1.2. The includeSubDomains Directive

The OPTIONAL "includeSubDomains" directive is a valueless directive which, if present (i.e., it is "asserted"), signals the UA that the HSTS Policy applies to this HSTS Host as well as any subdomains of the host's domain name.

( emphasis mine)

The certificate isn't valid for abc.foo.example.com, but I imagine that if there is a valid cert for such a host that the HSTS policy would apply there.

È corretto. La validità del certificato è ortogonale al fatto che un nome host sia soggetto a una restrizione di sicurezza del trasporto rigorosa.