Would HSTS cause an entire site (browser) to redirect to its HTTPS counterpart if a single (or more) resource from an HSTS domain was inserted into a HTTP site - e.g. through an 'img' tag?
We have http://subdomain.example.com loading an image from http(s)://www.example.com and then, incorrectly, http://subdomain.example.com redirects to http(s)://subdomain.example.com (causing the page to essentially break - it doesn't load at all) when the image is loaded. If we remove the image from the HTML the site functions correctly.
Is this expected behaviour and the essence of HSTS?
Note: we see www.example.com and example.com in the browser HSTS cache/store when the site loads the image. Clearing this causes the site to work fine, but subsequent reloads of the page then break (assuming because the browser has identified the HSTS once, and subsequent calls will then redirect following the HSTS policy/nature).
