Hacker News new | ask | show | jobs
by osteele 3023 days ago
example.amazon.co.uk and amazon.co.uk are not matching domains as defined in the RFC[1] (they are not congruent).

The includeSubDomains directive[2] allows the HSTS policy set for amazon.co.uk to apply to its subdomain example.amazon.co.uk, but not vice versa.

[1] https://tools.ietf.org/html/rfc6797#section-8.2

[2] https://tools.ietf.org/html/rfc6797#page-16