Would HSTS cause an entire site (browser) to redirect to its HTTPS counterpart if a single (or more) resource from an HSTS domain was inserted into a HTTP site - e.g. through an 'img' tag?
http://subdomain.example.com loading an image from
http(s)://www.example.com and then, incorrectly,
http://subdomain.example.com redirects to
http(s)://subdomain.example.com (causing the page to essentially break - it doesn't load at all) when the image is loaded. If we remove the image from the HTML the site functions correctly.
Is this expected behaviour and the essence of HSTS?
Note: we see
example.com in the browser HSTS cache/store when the site loads the image. Clearing this causes the site to work fine, but subsequent reloads of the page then break (assuming because the browser has identified the HSTS once, and subsequent calls will then redirect following the HSTS policy/nature).