Would HSTS cause an entire site (browser) to redirect to its HTTPS counterpart if a single (or more) resource from an HSTS domain was inserted into a HTTP site - e.g. through an 'img' tag?

We have http://subdomain.example.com loading an image from http(s)://www.example.com and then, incorrectly, http://subdomain.example.com redirects to http(s)://subdomain.example.com (causing the page to essentially break - it doesn't load at all) when the image is loaded. If we remove the image from the HTML the site functions correctly.

Is this expected behaviour and the essence of HSTS?

Note: we see www.example.com and example.com in the browser HSTS cache/store when the site loads the image. Clearing this causes the site to work fine, but subsequent reloads of the page then break (assuming because the browser has identified the HSTS once, and subsequent calls will then redirect following the HSTS policy/nature).

  • That depends. What have you set the headers to? May 10, 2019 at 3:09
  • Thanks for the reply. I haven't set the headers but a quick look at the domain on a HSTS checker has a clue "includeSubDomains".
    – Kinnectus
    May 10, 2019 at 4:29
  • Yes, that would do it. May 10, 2019 at 4:30
  • I had an epiphany to check that, in the middle of the night, when I was up tending to one of my kids who decided to wake up at 2am... Thank you for your quick responses
    – Kinnectus
    May 10, 2019 at 4:36


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.