0

On one of my sites I have Header set Strict-Transport-Security "max-age=31536000" env=HTTPS and this was enough for HSTS to be preloaded but the exact same snippet in my .htaccess file doesn't allow preloading on another site. I've went with Header set Strict-Transport-Security: "max-age=31536000; includeSubDomains; preload" env=HTTPS which fixed the issue but I'm wondering why the shorter version worked and preloaded a the first site but not the second?

Any insight would be appreciated.

learningtoanimate
  • 949
  • 6
  • 22
  • AFAIK you’ve always needed both `includeSubDomains;` and the `preload` attributes to be considered for the preload submission tool. Are you sure you are not setting them in your other site? Maybe in different config? – Barry Pollard Mar 27 '21 at 22:45
  • The config on both was identical which is why I was confused. – learningtoanimate Mar 28 '21 at 19:46

1 Answers1

1

why the shorter version worked

The short version couldn't have "worked". It would have been sufficient to implement HSTS, but not to have been accepted for the HSTS preload list.

Something else in your config must have been sending the complete header.

The only way to confirm what is actually going on is to record the HTTP request/response headers being sent on the request, not by the directives in your (.htaccess?) config file.

Even the directive you posted is not necessarily sufficient by itself. You must have something that is setting the HTTPS environment variable (this is not the same as the HTTPS server variable). And if you have canonical redirects from www to non-www (or vice versa) then you are missing the always argument to set the header on the 301 redirect (HTTPS only) - which is also a requirement of the "preload list".

It is far easier and less prone to error to implement HSTS "preload" in the server config. If you only have access to .htaccess then I would be hesitant to go for "preload list" submission.

See also my answer to the following related question on CodeReview SE:

MrWhite
  • 43,179
  • 8
  • 60
  • 84
  • The config on both was identical which is why I was confused. I apprecaite the information given in your response. I'm going to look into this more myself too to see what the difference was when they both use redirects and `.htaccess` in the same way. – learningtoanimate Mar 28 '21 at 19:47