[websec] #8: clarify/explain behavior when STS header not returned by known HSTS Host

"websec issue tracker" <trac+websec@trac.tools.ietf.org> Fri, 08 July 2011 22:59 UTC

MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: websec issue tracker <trac+websec@trac.tools.ietf.org>
Precedence: bulk
Auto-Submitted: auto-generated
To: jeff.hodges@kingsmountain.com
Date: Fri, 08 Jul 2011 22:59:27 -0000
Message-ID: <070.9ee40aea6eccfa2ee82e172d4a18d11f@trac.tools.ietf.org>
Cc: websec@ietf.org
Subject: [websec] #8: clarify/explain behavior when STS header not returned by known HSTS Host

#8: clarify/explain behavior when STS header not returned by  known HSTS Host

 http://www.ietf.org/mail-archive/web/websec/current/msg00045.html

 Subject: Re: [websec] Some questions about HSTS
 From: "Steingruebl, Andy" <asteingruebl@paypal-inc.com>
 Date: Mon, 22 Nov 2010 09:57:21 -0700 (08:57 PST)
 To: Yoav Nir <ynir@checkpoint.com>, "'websec@ietf.org'" <websec@ietf.org>

 <snip/>

 > My second question regards the UA behavior when policy changes. Suppose
 > a website has had the HSTS header for a while. The UA has a cache entry
 with
 > a TTL of several more weeks. Now the UA connects to the server (over
 > HTTPS) and does not get an HSTS header at all. What now?  If there was a
 > header and it was merely changed, the spec says to update the cache
 entry.
 > But if the header is missing altogether, does that mean that the UA
 should
 > delete the cache entry?

 I think we can make this clear, but until the client receives a new
 header, it does not tinker with the cache.  We do say the header should be
 present in all /most server responses, but the behavior should be that the
 value persists until set to something else.

-- 
-------------------------------------------+--------------------------------
 Reporter:  jeff.hodges@…                  |       Owner:  =JeffH
     Type:  defect                         |      Status:  new   
 Priority:  major                          |   Milestone:        
Component:  strict-transport-sec           |     Version:        
 Severity:  Active WG Document             |    Keywords:        
-------------------------------------------+--------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/websec/trac/ticket/8>
websec <http://tools.ietf.org/websec/>

[websec] #8: clarify/explain behavior when STS he… websec issue tracker
Re: [websec] #8: clarify/explain behavior when ST… websec issue tracker