Re: [websec] #37: Clarify that superdomain HSTS flag does not update max-age of subdomain's HSTS max-age and vice versa

"websec issue tracker" <trac+websec@trac.tools.ietf.org> Tue, 12 June 2012 18:24 UTC

MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: websec issue tracker <trac+websec@trac.tools.ietf.org>
Precedence: bulk
Auto-Submitted: auto-generated
To: draft-ietf-websec-strict-transport-sec@tools.ietf.org, jeff.hodges@kingsmountain.com
Date: Tue, 12 Jun 2012 18:24:30 -0000
Message-ID: <082.d8f57bd071bc0cc49d717772feaf72e2@trac.tools.ietf.org>
References: <067.4afd58f6d675d5bdb2f19d83a8c1d99a@trac.tools.ietf.org>
In-Reply-To: <067.4afd58f6d675d5bdb2f19d83a8c1d99a@trac.tools.ietf.org>
Resent-To:
Resent-Message-Id: <20120612182438.E264C21F85C6@ietfa.amsl.com>
Resent-Date: Tue, 12 Jun 2012 11:24:38 -0700
Resent-From: trac+websec@trac.tools.ietf.org
Cc: websec@ietf.org
Subject: Re: [websec] #37: Clarify that superdomain HSTS flag does not update max-age of subdomain's HSTS max-age and vice versa

#37: Clarify that superdomain HSTS flag does not update max-age of subdomain's
HSTS max-age and vice versa

#choose ticket.new
  #when True
 The case is the following: A UA notes a superdomain e.g. example.com as a
 Known HSTS Host, with "includeSubDomains". Then after that the UA also
 receives a HSTS header from subdomain foo.example.com (with or without
 "includeSubDomains") and new max-age (longer or shorter time).
 The point is in that case the HSTS timer of the superdomain (example.com)
 MUST NOT be changed (extended or shortened) to the timer used in the
 subdomain.
 In fact the UA MUST keep both timers in cache independently and if at some
 point either one of them is removed (be due to expiry or because of an
 update setting max-age=0), the second remaining HSTS value MUST still be
 kept intact and applied. This is mainly to prevent that a subdomain can
 invalidate the HSTS flag of the superdomain or make it expire and vice
 versa.
  #end
  #otherwise
    #if changes_body
Changes (by jeff.hodges@…):

 * status:  new => closed
 * resolution:   => fixed
 * severity:  - => In WG Last Call

    #end
    #if changes_descr
      #if not changes_body and not change.comment and change.author
Description changed by jeff.hodges@…:
      #end

--
    #end
    #if change.comment

Comment:

 fixed in -07
    #end
  #end
#end

-- 
-------------------------+-------------------------------------------------
 Reporter:               |       Owner:  draft-ietf-websec-strict-
  tobias.gondrom@…       |  transport-sec@…
     Type:  enhancement  |      Status:  closed
 Priority:  major        |   Milestone:
Component:  strict-      |     Version:
  transport-sec          |  Resolution:  fixed
 Severity:  In WG Last   |
  Call                   |
 Keywords:               |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/websec/trac/ticket/37#comment:1>
websec <http://tools.ietf.org/websec/>

[websec] #37: Clarify that superdomain HSTS flag … websec issue tracker
Re: [websec] #37: Clarify that superdomain HSTS f… websec issue tracker