News for hackers. Stuff that matters.

A comment on HTTP headers for the responsible developer. Parent comment

Re:HTTP headers for the responsible developer by nolok on Wednesday May 08, 2019 @08:05AM (#19858025)
> - Be sure that you understand the concept of HSTS! Simply copy/pasting the example from this article will completely break subdomains that are not HTTPS enabled and preloading will break it permanently. I wish the authors made that more clear. Don't use includesubdomains and preload unless you know what you are doing. Scott Helme also did a great article about this.

Great point that is even more important than people might realize at first when reading your comment, because it doesn't cover only your web properties; it covers all subdomains even those you forget you use and don't associate with your web presence.

You have a nas at nas.exemple.com, a webmail at mail.exemple.com, a third party cdn/similar routing at cdn.exemple.com, a printer interface at printer.office.exemple.com and other internals things at internally routed path, like that custom old dashboard written 15 years ago ? Include subdomain covers it, and preloading means you can't disable it once you realize you shouldn't have done it.

Seen a few small non-IT companies hit by that, and then asking for urgent consultancy to fix it.

[ Parent | on HN ]
Re:HTTP headers for the responsible developer by LeonM on Wednesday May 08, 2019 @09:02AM (#19858419)
> and then asking for urgent consultancy to fix it.

If it is preloaded (as the article suggest you should do), there is nothing you can do to 'fix' it, except migrating all other subdomains to HTTPS. Which is not always possible.

[ Parent | on HN ]
Re:HTTP headers for the responsible developer by nolok on Wednesday May 08, 2019 @09:30AM (#19858614)
Oh yes exactly, especially since they don't have much planned budget for it (small firms) it ends either with a lot of dirty proxying to have an HTTPS middle point, just because someone screwed up without paying attention to what they were actually doing, or with a secondary domain for the office.
[ Parent | on HN ]
Re:HTTP headers for the responsible developer by eridius on Wednesday May 08, 2019 @02:11PM (#19861431)
My subdomains for things like that all go through a reverse-proxy (Caddy) where I terminate HTTPS, which makes things simple, though I still don't use includesubdomains because it just seems too risky.
[ Parent | on HN ]