9

I would like to enforce HSTS for only 1 subdomain, but not the whole domain, is this possible ?

xxx.yyy.com -> HSTS on
zzz.yyy.com -> HSTS off
    yyy.com -> HSTS off
Improve this question
2
  • 1
    Recommended reading: The Wikipedia page and the RFC itself. There's implementation code for various web servers in the Wikipedia page and the answer to your question in the RFC.
    – Ladadadada
    Commented Feb 25, 2013 at 18:53
  • 1
    @Ladadadada, except that the RFC is, imo, not clear enough about domains. In this question, is the domain always yyy.com, or would issuing a sts header from xxx.yyy.com only apply to *.xxx.yyy.com (and thus treating xxx.yyy.com as the "domain")?
    – bvgheluwe
    Commented Sep 25, 2019 at 9:57

1 Answer 1

Reset to default
17

Yes.

Send the Strict-Transport-Security header only for xxx.yyy.com, and do not specify includeSubDomains.
Browsers that properly handle HSTS will only set the requirement for the specified subdomain (xxx.yyy.com) in this case.

Improve this answer
4
  • 2
    I'm just curious, what would happen if the Strict-Transport-Security on xxx.yyy.com did include the includeSubDomains? Wouldn't that only affect *.xxx.yyy.com?
    – Aaron Gibralter
    Commented Jun 12, 2015 at 3:58
  • 2
    @AaronGibralter That's my understanding (and my interpretation of the original question was "only for xxx.yyy.com" which is why I said not to set includeSubDomains) - If you want the subdomains of xxx.yyy.com to also enforce HSTS then you should set includeSubDomains in the header.
    – voretaq7
    Commented Jun 18, 2015 at 19:48
  • 2
    If includeSubDomains is present for xxx.yyy.com will it also affect *.yyy.com? (i.e. will it break zzz.yyy.com if it does not entertain HTTPS)?
    – mg007
    Commented Feb 6, 2016 at 7:31
  • I can confirm this. My bank has www.bank.com and homebanking.bank.com. Those are separate entries in the browser's hsts list and are created independently from each other. Chrome's hsts list can be searched through chrome://net-internals/#hsts -> "Query HSTS/PKP domain" (mind that it's an exact search: "bank" didn't yield a result).
    – bvgheluwe
    Commented Sep 25, 2019 at 11:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .