hsts-header-does-not-protect-subdomains.md

name	severity	cvss-score	cvss-vector	cwe-id	cwe-name	compliance
HSTS header does not protect subdomains	low	4.8	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N	CWE-319	Cleartext Transmission of Sensitive Information	HIPAA ISO 27001 owasp10 pci PCI v4.0 164.306(a), 164.312(c)(1), 164.312(e)(1) A.5.14, A.8.9, A.8.24 A2, A5 4.1, 6.5.4 pci4-4.2.1, pci4-6.2.4

The application is setting the Strict-Transport-Security header but with an insecure value, specifically without the includeSubdomains option. The includeSubdomains option will extend the benefit of the header to the subdomains, preventing situations where the attacker registers (or takes over) a subdomain and leverages that read session cookies from the parent domain.

How to fix

{% tabs hsts-header-does-not-protect-subdomains %} {% tab hsts-header-does-not-protect-subdomains generic %} The application should set the Strict-Transport-Security header with secure values. You just need to add the includeSubdomains option.

A secure header will look like this:

Strict-Transport-Security: max-age=15768000;includeSubdomains 

With the option includeSubdomains, all requests to URLs in the current domain and subdomains will go over HTTPS. When you set includeSubdomains make sure you can serve all requests over HTTPS! It is, however, important that you add the option includeSubdomains whenever is possible. {% endtab %}

{% endtabs %}