Run against its first real target the script reported "ok
strict-transport-security present". The response carried two of them:
strict-transport-security: max-age=63072000; includeSubDomains
strict-transport-security: max-age=63072000; preload
RFC 6797 section 8.1 -- more than one and the agent MUST process only the first
-- so what was in force was includeSubDomains without preload, and preload had
never once applied while the headers read, to a person, as though the site were
preload-ready. Two layers each adding their own is all it takes, and the second
is discarded in silence.
Each security header is now counted, and more than one is a finding naming the
directives that actually survive.
Two details that each took a wrong answer to get right, both the same class of
error the check exists to catch -- a tool answering confidently and wrongly:
- The value comes from the FIRST occurrence of the FINAL response block. Using
the last named the second header as the one in force, which is precisely
backwards, and curl -L concatenates every hop so an unscoped search quotes a
redirect's copy rather than the page's.
- It is quoted from the original headers rather than the lowercased copy used
for matching. Reporting `includesubdomains` to somebody who wrote
`includeSubDomains` shows them a value they never sent.
Verified against a local server serving each shape, and against the origin that
prompted it, where it now names 'max-age=63072000; includeSubDomains' as in
force -- matching the wire byte for byte.
closes#12
bbf2a0a1ac