[whatwg/fetch] Double-keyed HSTS (#920)

Related to #904, #917, we should consider HSTS as well. Per https://webkit.org/blog/8146/protecting-against-hsts-abuse/ Safari has this.

What's written down there is not entirely unambiguous so I hope @bfulgham or @johnwilander can elaborate. In particular, is it really the top-level domain or the public suffix? It also seems like it might only consider HSTS when it's delivered with a top-level navigation?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/920