preflight.sh calls a duplicated header present when only the first one counts #12

New Issue

Closed

opened 2026-08-17 23:25:34 -05:00 by null · 0 comments

null commented

2026-08-17 23:25:34 -05:00

Owner

Run passively against privacyllc.dev, preflight.sh reported ok strict-transport-security present. The response actually carries two of them, in one response:

strict-transport-security: max-age=63072000; includeSubDomains
strict-transport-security: max-age=63072000; preload

RFC 6797 section 8.1: a user agent that receives more than one STS header field MUST process only the first and ignore the rest. So what is in force is includeSubDomains without preload, and the preload directive has never done anything — while the headers read, to a person, as though the site were preload-ready. hstspreload.org requires max-age, includeSubDomains and preload in a single header, so a submission would also be rejected.

The general shape is worth catching, not just this instance: a security header that is present is not the same as one that is in force. Two layers each adding their own is the ordinary cause, and the second is silently discarded.

Check each security header it already looks for, and report a count above one as a finding naming which directives are actually in force — the first occurrence — and which are being discarded.

Scope: this reports duplication, not policy quality. A default-src * is still a CSP and judging that is a person's job, as the script's header already says.

Verify: given a response with two Strict-Transport-Security headers, preflight.sh reports a finding naming the surviving directives and exits 1; given one header it stays quiet.

Run passively against privacyllc.dev, `preflight.sh` reported `ok strict-transport-security present`. The response actually carries **two** of them, in one response: strict-transport-security: max-age=63072000; includeSubDomains strict-transport-security: max-age=63072000; preload RFC 6797 section 8.1: a user agent that receives more than one STS header field MUST process only the first and ignore the rest. So what is in force is `includeSubDomains` without `preload`, and the `preload` directive has never done anything — while the headers read, to a person, as though the site were preload-ready. hstspreload.org requires `max-age`, `includeSubDomains` and `preload` in a single header, so a submission would also be rejected. The general shape is worth catching, not just this instance: **a security header that is present is not the same as one that is in force.** Two layers each adding their own is the ordinary cause, and the second is silently discarded. Check each security header it already looks for, and report a count above one as a finding naming which directives are actually in force — the first occurrence — and which are being discarded. Scope: this reports duplication, not policy quality. A `default-src *` is still a CSP and judging that is a person's job, as the script's header already says. Verify: given a response with two `Strict-Transport-Security` headers, preflight.sh reports a finding naming the surviving directives and exits 1; given one header it stays quiet.