Re: Redirects and HSTS

On 09/27/2014 02:54 AM, Anne van Kesteren wrote:
> On Sat, Sep 27, 2014 at 8:36 AM, Ryan Sleevi <sleevi@google.com> wrote:
>> Plus the request itself will have already leaked the salient details.
> 
> How so?

consider trying to protect a cookie set for foo.example.  the website
sends HSTS headers, but it sloppy and hasn't set the secure flag on the
cookie.

If an attacker in control of http://bar.example can include <img
src="http://foo.example/image.png"/>  and the client is willing to fetch
it without acting on its HSTS knowledge about foo.example, then it will
leak the cookie to any attacker observing the network.

 --dkg